General

  • Target

    5f4321d6cab1545344c0bbcbc76a0ba2.dll

  • Size

    547KB

  • Sample

    230119-xmj2ksgh86

  • MD5

    5f4321d6cab1545344c0bbcbc76a0ba2

  • SHA1

    0bc8f623c43bbd5f4411ca65aaeea3937f11bedd

  • SHA256

    95700067aa7b2852e7c7ce0b827857b3231ce44afffec7b12f35faf12881b499

  • SHA512

    21337af9fb4936bb757a344ec60778cfb10f1bc13c9bb22f9f9931be985b593d3858ca86d6ec11f1c78d517260172556bc7bc46d41df3df85a435eff0751eb32

  • SSDEEP

    12288:W+JYobIU5CLB3GW6RpXoM6k8E/lnn7NAdLT1:WZ3GWm9ok8e7NA5T1

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

198.199.126.144:443

103.42.57.17:8080

195.154.146.35:443

104.131.62.48:8080

116.124.128.206:8080

54.38.242.185:443

217.182.143.207:443

66.42.57.149:443

185.148.168.220:8080

37.44.244.177:8080

78.47.204.80:443

173.203.78.138:443

190.90.233.66:443

203.153.216.46:443

54.37.106.167:8080

194.9.172.107:8080

168.197.250.14:80

185.184.25.78:8080

191.252.103.16:80

159.69.237.188:443

eck1.plain
ecs1.plain

Targets

    • Target

      5f4321d6cab1545344c0bbcbc76a0ba2.dll

    • Size

      547KB

    • MD5

      5f4321d6cab1545344c0bbcbc76a0ba2

    • SHA1

      0bc8f623c43bbd5f4411ca65aaeea3937f11bedd

    • SHA256

      95700067aa7b2852e7c7ce0b827857b3231ce44afffec7b12f35faf12881b499

    • SHA512

      21337af9fb4936bb757a344ec60778cfb10f1bc13c9bb22f9f9931be985b593d3858ca86d6ec11f1c78d517260172556bc7bc46d41df3df85a435eff0751eb32

    • SSDEEP

      12288:W+JYobIU5CLB3GW6RpXoM6k8E/lnn7NAdLT1:WZ3GWm9ok8e7NA5T1

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Matrix

Tasks