General

  • Target

    5aefd49a03a4810e6dd2b73395deb12b.dll

  • Size

    233KB

  • Sample

    230119-xpvwvsgh97

  • MD5

    5aefd49a03a4810e6dd2b73395deb12b

  • SHA1

    7706a62fa35616037c6ce35d71eea6fa10cc0eac

  • SHA256

    f3842cd4b63be5212f9d13436938759fc5d1966bdad0cec0819f87cfbfb3adec

  • SHA512

    2e622a4c7cc2da5a4dee64823fa42b499749fd473dee5d0e9703e08b8d4f564b57a8eb6c75eb057d02d25f81ccc851f1ab266ab68ae4c3eb8c266a8cc8bf44ff

  • SSDEEP

    3072:KC1sUJsEIoECTFM5/A8eWLdlU8thEnYsqibnjPw+a5DIYvK8UIDoQQh3:KC1NJMoEywAkdrHEn1qibjm5DIYSX

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

184.66.18.83:80

202.187.222.40:80

167.71.148.58:443

211.215.18.93:8080

1.234.65.61:80

80.15.100.37:80

155.186.9.160:80

172.104.169.32:8080

110.39.162.2:443

12.162.84.2:8080

181.136.190.86:80

68.183.190.199:8080

191.223.36.170:80

190.45.24.210:80

81.213.175.132:80

181.120.29.49:80

82.76.111.249:443

177.23.7.151:80

95.76.153.115:80

93.148.247.169:80

rsa_pubkey.plain

Targets

    • Target

      5aefd49a03a4810e6dd2b73395deb12b.dll

    • Size

      233KB

    • MD5

      5aefd49a03a4810e6dd2b73395deb12b

    • SHA1

      7706a62fa35616037c6ce35d71eea6fa10cc0eac

    • SHA256

      f3842cd4b63be5212f9d13436938759fc5d1966bdad0cec0819f87cfbfb3adec

    • SHA512

      2e622a4c7cc2da5a4dee64823fa42b499749fd473dee5d0e9703e08b8d4f564b57a8eb6c75eb057d02d25f81ccc851f1ab266ab68ae4c3eb8c266a8cc8bf44ff

    • SSDEEP

      3072:KC1sUJsEIoECTFM5/A8eWLdlU8thEnYsqibnjPw+a5DIYvK8UIDoQQh3:KC1NJMoEywAkdrHEn1qibjm5DIYSX

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks