General

  • Target

    610495f8a80fd9348be292c1c0e52d2af76dbbaada26c23695543a3e019d60d8

  • Size

    271KB

  • Sample

    221130-w5zpbagg3s

  • MD5

    1c5897debecbe567e256b56a81e85dd9

  • SHA1

    93288189cb6708c264e77bf1416207bd99a71c5d

  • SHA256

    610495f8a80fd9348be292c1c0e52d2af76dbbaada26c23695543a3e019d60d8

  • SHA512

    d798afdd0f9f1793e84e3b5f3c44de5951a589d7862cec4dcb5d65b7eb30eca7a1298eb363ba7a943cc969202853ea9cce13078d19884566f59c1bb8be764148

  • SSDEEP

    6144:+60EDP6uCLfGw/GpxXinM1BCo1PlumGx2mx2tXd0t115JGB:X5DpBw/KViMTB1MnEWk0115Jm

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

200.75.39.254:80

201.185.69.28:443

206.189.232.2:8080

138.197.99.250:8080

167.71.148.58:443

190.45.24.210:80

110.39.162.2:443

201.75.62.86:80

46.105.114.137:8080

190.247.139.101:80

59.148.253.194:8080

137.74.106.111:7080

202.79.24.136:443

177.85.167.10:80

80.15.100.37:80

45.16.226.117:443

190.24.243.186:80

138.97.60.141:7080

2.80.112.146:80

81.214.253.80:443

rsa_pubkey.plain

Targets

    • Target

      610495f8a80fd9348be292c1c0e52d2af76dbbaada26c23695543a3e019d60d8

    • Size

      271KB

    • MD5

      1c5897debecbe567e256b56a81e85dd9

    • SHA1

      93288189cb6708c264e77bf1416207bd99a71c5d

    • SHA256

      610495f8a80fd9348be292c1c0e52d2af76dbbaada26c23695543a3e019d60d8

    • SHA512

      d798afdd0f9f1793e84e3b5f3c44de5951a589d7862cec4dcb5d65b7eb30eca7a1298eb363ba7a943cc969202853ea9cce13078d19884566f59c1bb8be764148

    • SSDEEP

      6144:+60EDP6uCLfGw/GpxXinM1BCo1PlumGx2mx2tXd0t115JGB:X5DpBw/KViMTB1MnEWk0115Jm

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks