General

  • Target

    ec5994b78ec3837eac38e35501dc98db.dll

  • Size

    611KB

  • Sample

    230119-xlytcagh85

  • MD5

    ec5994b78ec3837eac38e35501dc98db

  • SHA1

    7477781b804221800c03498cf7349c3bfff9b50c

  • SHA256

    c51b13f52af8a5e9cf59ebabd2487b9e522bb135a3d607f7f459ccf15692b3c1

  • SHA512

    258e16f7456c993e5fe08d90fa22ab182a6ffa0f1bd43f9565f0dd2f110f727ae1c05f82500a44cac04f0257d9c92cec8aa55ba1c90351fddd614bf726a5a3af

  • SSDEEP

    12288:J1U8sNY8/z0rYebzwdRCoGEAbcVBLku8w:oq6z0rYcMdRVGEZBLkuF

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

186.250.48.5:80

168.119.39.118:443

185.168.130.138:443

190.90.233.66:443

159.69.237.188:443

54.37.228.122:443

93.104.209.107:8080

185.148.168.15:8080

198.199.98.78:8080

87.106.97.83:7080

195.77.239.39:8080

37.44.244.177:8080

54.38.242.185:443

185.184.25.78:8080

116.124.128.206:8080

139.196.72.155:8080

128.199.192.135:8080

103.41.204.169:8080

78.47.204.80:443

68.183.93.250:443

eck1.plain
ecs1.plain

Targets

    • Target

      ec5994b78ec3837eac38e35501dc98db.dll

    • Size

      611KB

    • MD5

      ec5994b78ec3837eac38e35501dc98db

    • SHA1

      7477781b804221800c03498cf7349c3bfff9b50c

    • SHA256

      c51b13f52af8a5e9cf59ebabd2487b9e522bb135a3d607f7f459ccf15692b3c1

    • SHA512

      258e16f7456c993e5fe08d90fa22ab182a6ffa0f1bd43f9565f0dd2f110f727ae1c05f82500a44cac04f0257d9c92cec8aa55ba1c90351fddd614bf726a5a3af

    • SSDEEP

      12288:J1U8sNY8/z0rYebzwdRCoGEAbcVBLku8w:oq6z0rYcMdRVGEZBLkuF

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Matrix

Tasks