General

  • Target

    8e5b71716b7864c89638c623253fddefd1a6e9bbf422cfb164de1cb7d508678c

  • Size

    318KB

  • Sample

    221130-q5clwshg9x

  • MD5

    e9d51a17dedecd6c147c8f76c647d924

  • SHA1

    12e66e91565170ccf34a12f23b71cfb106725d11

  • SHA256

    8e5b71716b7864c89638c623253fddefd1a6e9bbf422cfb164de1cb7d508678c

  • SHA512

    291048113ebcda03d81e372d2f1ecc592675a7a87e966979f3c04cc7fed2c86bc682c4a75399f36fe835d78bd9c9627a04410aea02ea724cc621281c37b0bec2

  • SSDEEP

    6144:m0YT8pz4Xzi7BapCK5d3klRzULOnWyjLsPhAQzOs+:/M8F4Xzi4pdd3klnnWosPhnzO3

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

60.125.114.64:443

91.121.200.35:8080

159.203.16.11:8080

188.226.165.170:8080

36.91.44.183:80

5.12.246.155:80

172.193.79.237:80

190.180.65.104:80

46.32.229.152:8080

58.27.215.3:8080

75.127.14.170:8080

198.20.228.9:8080

37.205.9.252:7080

120.51.34.254:80

41.185.29.128:8080

172.105.78.244:8080

175.103.38.146:80

190.164.135.81:80

183.91.3.63:80

109.13.179.195:80

rsa_pubkey.plain

Targets

    • Target

      8e5b71716b7864c89638c623253fddefd1a6e9bbf422cfb164de1cb7d508678c

    • Size

      318KB

    • MD5

      e9d51a17dedecd6c147c8f76c647d924

    • SHA1

      12e66e91565170ccf34a12f23b71cfb106725d11

    • SHA256

      8e5b71716b7864c89638c623253fddefd1a6e9bbf422cfb164de1cb7d508678c

    • SHA512

      291048113ebcda03d81e372d2f1ecc592675a7a87e966979f3c04cc7fed2c86bc682c4a75399f36fe835d78bd9c9627a04410aea02ea724cc621281c37b0bec2

    • SSDEEP

      6144:m0YT8pz4Xzi7BapCK5d3klRzULOnWyjLsPhAQzOs+:/M8F4Xzi4pdd3klnnWosPhnzO3

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks