General

  • Target

    60de82a6a35a79197cf170012c1326af3c304e07a98d60c7b580ca82f8e4f8d8

  • Size

    271KB

  • Sample

    221130-q6atpahh8v

  • MD5

    6f1cf8ea61c7ea651c092f29df4fd76b

  • SHA1

    8065a8c1d025e1f166bdb6fb6583b21e2763fefe

  • SHA256

    60de82a6a35a79197cf170012c1326af3c304e07a98d60c7b580ca82f8e4f8d8

  • SHA512

    856ebbb37c5e63a4cffc91d44c72b60bf63c5c27518f02bfc2d2b4bb5eb751d6f1bfd47a7e47c9a7559d2e6995a8a6463befde9165bf222e9500e1c8304163c5

  • SSDEEP

    6144:+60EDP6uCLfGw/GpxXinM1BCo1PlumGx2mx2tXd0t115JGU:X5DpBw/KViMTB1MnEWk0115JH

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

200.75.39.254:80

201.185.69.28:443

206.189.232.2:8080

138.197.99.250:8080

167.71.148.58:443

190.45.24.210:80

110.39.162.2:443

201.75.62.86:80

46.105.114.137:8080

190.247.139.101:80

59.148.253.194:8080

137.74.106.111:7080

202.79.24.136:443

177.85.167.10:80

80.15.100.37:80

45.16.226.117:443

190.24.243.186:80

138.97.60.141:7080

2.80.112.146:80

81.214.253.80:443

rsa_pubkey.plain

Targets

    • Target

      60de82a6a35a79197cf170012c1326af3c304e07a98d60c7b580ca82f8e4f8d8

    • Size

      271KB

    • MD5

      6f1cf8ea61c7ea651c092f29df4fd76b

    • SHA1

      8065a8c1d025e1f166bdb6fb6583b21e2763fefe

    • SHA256

      60de82a6a35a79197cf170012c1326af3c304e07a98d60c7b580ca82f8e4f8d8

    • SHA512

      856ebbb37c5e63a4cffc91d44c72b60bf63c5c27518f02bfc2d2b4bb5eb751d6f1bfd47a7e47c9a7559d2e6995a8a6463befde9165bf222e9500e1c8304163c5

    • SSDEEP

      6144:+60EDP6uCLfGw/GpxXinM1BCo1PlumGx2mx2tXd0t115JGU:X5DpBw/KViMTB1MnEWk0115JH

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks