General

  • Target

    7f8833e01027753003c2540ec9e723e3feb93e83.exe

  • Size

    492KB

  • Sample

    221130-k8kh1sfh44

  • MD5

    4a0e07690ba066341d7cd8df29daf966

  • SHA1

    7f8833e01027753003c2540ec9e723e3feb93e83

  • SHA256

    0a91ca038be80280f9e9e300dafd4490be9269d1ad7649f102aa5c58b7d7a9db

  • SHA512

    b14d00b021393fee638a8ade28155bd0738844cacb8ca55fe5df77a891da43fb57fd31d2f7f0e0164356e7206a47a64b06ff42d012772ab0ed65970aaa007a6a

  • SSDEEP

    12288:f1n6BAlECcMIR4WlptZ2uOIR4bi6/Myw52BLhzqzE:f16SbcMMlpLLO6E

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

110.36.234.146:80

191.82.16.60:80

91.83.93.105:8080

216.98.148.181:8080

68.183.190.199:8080

190.230.60.129:80

183.82.97.25:80

114.79.134.129:443

89.188.124.145:443

178.79.163.131:8080

76.69.29.42:80

87.106.77.40:7080

178.249.187.151:8080

62.75.143.100:7080

201.163.74.202:443

62.75.160.178:8080

181.188.149.134:80

186.0.95.172:80

217.199.160.224:8080

203.25.159.3:8080

rsa_pubkey.plain

Targets

    • Target

      7f8833e01027753003c2540ec9e723e3feb93e83.exe

    • Size

      492KB

    • MD5

      4a0e07690ba066341d7cd8df29daf966

    • SHA1

      7f8833e01027753003c2540ec9e723e3feb93e83

    • SHA256

      0a91ca038be80280f9e9e300dafd4490be9269d1ad7649f102aa5c58b7d7a9db

    • SHA512

      b14d00b021393fee638a8ade28155bd0738844cacb8ca55fe5df77a891da43fb57fd31d2f7f0e0164356e7206a47a64b06ff42d012772ab0ed65970aaa007a6a

    • SSDEEP

      12288:f1n6BAlECcMIR4WlptZ2uOIR4bi6/Myw52BLhzqzE:f16SbcMMlpLLO6E

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks