General

  • Target

    554c2c59f3d24401b549552c309018e214bba4fe4b7fd44839aefe517a6c4ea3

  • Size

    271KB

  • Sample

    221125-kxyw9sad2y

  • MD5

    6566fe7b2feaf016fd23f0e29b6298dc

  • SHA1

    3b6de6bf068d9aed95685e20b9705b5064935dc8

  • SHA256

    554c2c59f3d24401b549552c309018e214bba4fe4b7fd44839aefe517a6c4ea3

  • SHA512

    274f2e07de568d0b811f6da8c2ef2e1a733747a677852e32e246e84dfbdcbe84bd4a230c1f59a0bc6f37402ef30af15b33dd590d1042e0295a5d342feb4afefd

  • SSDEEP

    6144:+60EDP6uCLfGw/GpxXinM1BCo1PlumGx2mx2tXd0t115JGY:X5DpBw/KViMTB1MnEWk0115Jf

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

200.75.39.254:80

201.185.69.28:443

206.189.232.2:8080

138.197.99.250:8080

167.71.148.58:443

190.45.24.210:80

110.39.162.2:443

201.75.62.86:80

46.105.114.137:8080

190.247.139.101:80

59.148.253.194:8080

137.74.106.111:7080

202.79.24.136:443

177.85.167.10:80

80.15.100.37:80

45.16.226.117:443

190.24.243.186:80

138.97.60.141:7080

2.80.112.146:80

81.214.253.80:443

rsa_pubkey.plain

Targets

    • Target

      554c2c59f3d24401b549552c309018e214bba4fe4b7fd44839aefe517a6c4ea3

    • Size

      271KB

    • MD5

      6566fe7b2feaf016fd23f0e29b6298dc

    • SHA1

      3b6de6bf068d9aed95685e20b9705b5064935dc8

    • SHA256

      554c2c59f3d24401b549552c309018e214bba4fe4b7fd44839aefe517a6c4ea3

    • SHA512

      274f2e07de568d0b811f6da8c2ef2e1a733747a677852e32e246e84dfbdcbe84bd4a230c1f59a0bc6f37402ef30af15b33dd590d1042e0295a5d342feb4afefd

    • SSDEEP

      6144:+60EDP6uCLfGw/GpxXinM1BCo1PlumGx2mx2tXd0t115JGY:X5DpBw/KViMTB1MnEWk0115Jf

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks