General

  • Target

    c12ab21809e1dd265788e91e18807d66.dll

  • Size

    600KB

  • Sample

    230119-xmj2ksgh88

  • MD5

    c12ab21809e1dd265788e91e18807d66

  • SHA1

    2d3bdbcc09ae379dedadbcd27efecb7c36afbff0

  • SHA256

    7eecd4165c6be116e7106a91251705efdd07da4f55fc7eee70bf89ec8a768fcc

  • SHA512

    b36dd4e3204916a075c7369532ab9ec1c3bb1a902ec7c8e5078b8e2e547732f6e32524177b74938e5b710f07d8b8caed2195e8dbfa6ec70e895ef47fc33e7b31

  • SSDEEP

    12288:l4WjRiEKWKhqyuYzqtNNH2AyKK6cl788IO/:9KWKh/ZqtT2AJuQBO

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

103.42.57.17:8080

93.104.208.37:8080

195.154.146.35:443

62.171.178.147:8080

37.59.209.141:8080

139.196.72.155:8080

37.44.244.177:8080

191.252.103.16:80

217.182.143.207:443

128.199.192.135:8080

103.41.204.169:8080

185.148.168.15:8080

168.197.250.14:80

78.46.73.125:443

194.9.172.107:8080

185.148.168.220:8080

118.98.72.86:443

54.37.106.167:8080

78.47.204.80:443

159.69.237.188:443

eck1.plain
ecs1.plain

Targets

    • Target

      c12ab21809e1dd265788e91e18807d66.dll

    • Size

      600KB

    • MD5

      c12ab21809e1dd265788e91e18807d66

    • SHA1

      2d3bdbcc09ae379dedadbcd27efecb7c36afbff0

    • SHA256

      7eecd4165c6be116e7106a91251705efdd07da4f55fc7eee70bf89ec8a768fcc

    • SHA512

      b36dd4e3204916a075c7369532ab9ec1c3bb1a902ec7c8e5078b8e2e547732f6e32524177b74938e5b710f07d8b8caed2195e8dbfa6ec70e895ef47fc33e7b31

    • SSDEEP

      12288:l4WjRiEKWKhqyuYzqtNNH2AyKK6cl788IO/:9KWKh/ZqtT2AJuQBO

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Matrix

Tasks