General

  • Target

    5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe

  • Size

    596KB

  • Sample

    221130-k5llxafe98

  • MD5

    2c4d542a55d21e92352d798b47f5fada

  • SHA1

    5b08375c935c2e2b2b8f59583dabe7ecc301a65f

  • SHA256

    3ed3759a7759fd6cffc0bddfc01d262f1a8a47b10ee5c4c2192547f7f47683d1

  • SHA512

    25ba8b1f48bd9e5ef7f293cb9afb53c2e399c119317eb1cde934ce55337d75986aeecbc1001e536cf1bfd765f757d3241294ee5f55596d383cd1a5f2a3a23a21

  • SSDEEP

    12288:XOznWAlABfLGB5kvtjV7uikFgXLNJ7HCxH5:mSoB5wdlubgXLNJCxH5

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

125.99.61.162:7080

94.183.71.206:7080

91.83.93.105:8080

216.98.148.181:8080

68.183.190.199:8080

170.84.133.72:7080

139.5.237.27:443

5.77.13.70:80

46.29.183.211:8080

46.41.151.103:8080

182.188.39.68:80

170.84.133.72:8443

186.83.133.253:8080

46.28.111.142:7080

62.75.160.178:8080

178.79.163.131:8080

190.104.253.234:990

149.62.173.247:8080

178.249.187.151:8080

81.169.140.14:443

rsa_pubkey.plain

Targets

    • Target

      5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe

    • Size

      596KB

    • MD5

      2c4d542a55d21e92352d798b47f5fada

    • SHA1

      5b08375c935c2e2b2b8f59583dabe7ecc301a65f

    • SHA256

      3ed3759a7759fd6cffc0bddfc01d262f1a8a47b10ee5c4c2192547f7f47683d1

    • SHA512

      25ba8b1f48bd9e5ef7f293cb9afb53c2e399c119317eb1cde934ce55337d75986aeecbc1001e536cf1bfd765f757d3241294ee5f55596d383cd1a5f2a3a23a21

    • SSDEEP

      12288:XOznWAlABfLGB5kvtjV7uikFgXLNJ7HCxH5:mSoB5wdlubgXLNJCxH5

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks