General

  • Target

    1d703d84368e0c53f6706276da6858bdd7df55e6.exe

  • Size

    276KB

  • Sample

    221130-gva6msdb56

  • MD5

    276d2ef178f1d319a7ab74aee99917bf

  • SHA1

    1d703d84368e0c53f6706276da6858bdd7df55e6

  • SHA256

    09819925fdc296619617875dc4a026ed5657b455c0520c53729430e951e752f2

  • SHA512

    cf8d467ad34d4612e3b6319f2b8e81df36adeecdc59b6d9377b850755536e2d713badebddaafac882a38c3481e0c2006ce7ad0054129092f71ce63115fa376ba

  • SSDEEP

    3072:7nuxOYPgjfFO+f5/Tx/udGrNGDxD4O8WfRtaG/70Jfm4JuLYwO9/+Tl:OPgjNl/8kIxD4OdpzcflQu1+

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

124.240.198.66:80

186.75.241.230:80

181.143.194.138:443

45.79.188.67:8080

77.237.248.136:8080

185.142.236.163:443

63.142.253.122:8080

178.254.6.27:7080

190.211.207.11:443

78.188.105.159:21

182.176.106.43:995

178.79.161.166:443

206.189.98.125:8080

87.230.19.21:8080

80.11.163.139:443

101.187.237.217:20

190.18.146.70:80

86.98.25.30:53

92.222.125.16:7080

186.4.172.5:443

rsa_pubkey.plain

Targets

    • Target

      1d703d84368e0c53f6706276da6858bdd7df55e6.exe

    • Size

      276KB

    • MD5

      276d2ef178f1d319a7ab74aee99917bf

    • SHA1

      1d703d84368e0c53f6706276da6858bdd7df55e6

    • SHA256

      09819925fdc296619617875dc4a026ed5657b455c0520c53729430e951e752f2

    • SHA512

      cf8d467ad34d4612e3b6319f2b8e81df36adeecdc59b6d9377b850755536e2d713badebddaafac882a38c3481e0c2006ce7ad0054129092f71ce63115fa376ba

    • SSDEEP

      3072:7nuxOYPgjfFO+f5/Tx/udGrNGDxD4O8WfRtaG/70Jfm4JuLYwO9/+Tl:OPgjNl/8kIxD4OdpzcflQu1+

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks