General

  • Target

    79ff73e11f26cd97ff4103324b2ef795e40196181710d38014a35c6b510c6745

  • Size

    161KB

  • Sample

    221125-l5h2fsdb3x

  • MD5

    18992bf4fddae0fc9e28a7c624752717

  • SHA1

    90faac1124b96838399fbad917de1e6fa77affe6

  • SHA256

    79ff73e11f26cd97ff4103324b2ef795e40196181710d38014a35c6b510c6745

  • SHA512

    d3aac8c562d2c551681641186c71003038c0c3303dfa1dbf1cad08c6554da4073f5eb4bda7f431447ee7cb6004d73bc8942ab9b170c50e6d7225935068e7c7de

  • SSDEEP

    3072:C3W5kHsTYkZze+hVJ96hpKDa5OpA98EEXfc5ikSxAx83LNguZvWlsZQSGN+:i3WYkte+/Ly8bAF0fY7S2CfC

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

60.125.114.64:443

91.121.200.35:8080

159.203.16.11:8080

188.226.165.170:8080

36.91.44.183:80

5.12.246.155:80

172.193.79.237:80

190.180.65.104:80

46.32.229.152:8080

58.27.215.3:8080

75.127.14.170:8080

198.20.228.9:8080

37.205.9.252:7080

120.51.34.254:80

41.185.29.128:8080

172.105.78.244:8080

175.103.38.146:80

190.164.135.81:80

183.91.3.63:80

109.13.179.195:80

rsa_pubkey.plain

Targets

    • Target

      79ff73e11f26cd97ff4103324b2ef795e40196181710d38014a35c6b510c6745

    • Size

      161KB

    • MD5

      18992bf4fddae0fc9e28a7c624752717

    • SHA1

      90faac1124b96838399fbad917de1e6fa77affe6

    • SHA256

      79ff73e11f26cd97ff4103324b2ef795e40196181710d38014a35c6b510c6745

    • SHA512

      d3aac8c562d2c551681641186c71003038c0c3303dfa1dbf1cad08c6554da4073f5eb4bda7f431447ee7cb6004d73bc8942ab9b170c50e6d7225935068e7c7de

    • SSDEEP

      3072:C3W5kHsTYkZze+hVJ96hpKDa5OpA98EEXfc5ikSxAx83LNguZvWlsZQSGN+:i3WYkte+/Ly8bAF0fY7S2CfC

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks