General

  • Target

    622a1a8f9ed850f507b177e8098084a440cb204c60b1e6a1b9b023c98c91c594

  • Size

    474KB

  • Sample

    221130-rv37jaca9z

  • MD5

    b96235b9e1570648834439e99317b461

  • SHA1

    ce5eef6c6e30fc62ee0c7d1311fcac4254a85491

  • SHA256

    622a1a8f9ed850f507b177e8098084a440cb204c60b1e6a1b9b023c98c91c594

  • SHA512

    6143d51d5b599195c6cfc53bc7c86d03f6bf78d7106908f50b385e2314d979e0ecee1e38be56a94f805d6d26b2619f7311d3125b0b2ba2b7aae44f5d41a57351

  • SSDEEP

    6144:0lz4Ie8TvPgADDnz/HXnr/vYito3LFDPMTJYhr64Fg0:84Iuim3LFPMdV4Fg0

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

181.123.0.125:80

119.159.150.176:443

184.69.214.94:20

80.240.141.141:7080

185.187.198.10:8080

46.41.134.46:8080

178.249.187.151:8080

217.199.160.224:8080

186.83.133.253:8080

23.92.22.225:7080

212.71.237.140:8080

190.221.50.210:8080

187.199.158.226:443

185.86.148.222:8080

200.58.171.51:80

77.245.101.134:8080

201.163.74.202:443

203.25.159.3:8080

183.82.97.25:80

51.15.8.192:8080

rsa_pubkey.plain

Targets

    • Target

      622a1a8f9ed850f507b177e8098084a440cb204c60b1e6a1b9b023c98c91c594

    • Size

      474KB

    • MD5

      b96235b9e1570648834439e99317b461

    • SHA1

      ce5eef6c6e30fc62ee0c7d1311fcac4254a85491

    • SHA256

      622a1a8f9ed850f507b177e8098084a440cb204c60b1e6a1b9b023c98c91c594

    • SHA512

      6143d51d5b599195c6cfc53bc7c86d03f6bf78d7106908f50b385e2314d979e0ecee1e38be56a94f805d6d26b2619f7311d3125b0b2ba2b7aae44f5d41a57351

    • SSDEEP

      6144:0lz4Ie8TvPgADDnz/HXnr/vYito3LFDPMTJYhr64Fg0:84Iuim3LFPMdV4Fg0

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks