General

  • Target

    5397887cac09d8d9f50871894ada5dfb.dll

  • Size

    514KB

  • Sample

    230119-xmj2ksgh87

  • MD5

    5397887cac09d8d9f50871894ada5dfb

  • SHA1

    67a4b778ddc036e85d64585965f2cb2fb9bc699d

  • SHA256

    62b4e33474fa6ef9e22b8f22b1918315e6ecb6d18066d3b1e7a29181d29323f6

  • SHA512

    55a5655e5d7ed6f84ad024eb1b58c0ffc31e957c16782acd49b3cc1a3b0515ff7e742c1247fd2dae9ebe11989f21bdc4c08a8dd9b7c2b4db51bfafb194a675f7

  • SSDEEP

    6144:LVvauc175GwSlLaD0adqHQFHQFHQFHQFHQZcH+J8aLi/ZnZLtO/ydWp3kklPSiNO:LViuc175Gw/DtcUKmvJSYCQqTI

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

198.199.126.144:443

103.42.57.17:8080

195.154.146.35:443

104.131.62.48:8080

116.124.128.206:8080

54.38.242.185:443

217.182.143.207:443

66.42.57.149:443

185.148.168.220:8080

37.44.244.177:8080

78.47.204.80:443

173.203.78.138:443

190.90.233.66:443

203.153.216.46:443

54.37.106.167:8080

194.9.172.107:8080

168.197.250.14:80

185.184.25.78:8080

191.252.103.16:80

159.69.237.188:443

eck1.plain
ecs1.plain

Targets

    • Target

      5397887cac09d8d9f50871894ada5dfb.dll

    • Size

      514KB

    • MD5

      5397887cac09d8d9f50871894ada5dfb

    • SHA1

      67a4b778ddc036e85d64585965f2cb2fb9bc699d

    • SHA256

      62b4e33474fa6ef9e22b8f22b1918315e6ecb6d18066d3b1e7a29181d29323f6

    • SHA512

      55a5655e5d7ed6f84ad024eb1b58c0ffc31e957c16782acd49b3cc1a3b0515ff7e742c1247fd2dae9ebe11989f21bdc4c08a8dd9b7c2b4db51bfafb194a675f7

    • SSDEEP

      6144:LVvauc175GwSlLaD0adqHQFHQFHQFHQFHQZcH+J8aLi/ZnZLtO/ydWp3kklPSiNO:LViuc175Gw/DtcUKmvJSYCQqTI

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Matrix

Tasks