General

  • Target

    9f35e7c5a02f30bdde73e1ac97b9f45e755e722887d4f6f21737d3fc4309e197

  • Size

    346KB

  • Sample

    230129-zyacmach78

  • MD5

    fd0e21bdbe19856ba45f049b2932d9f5

  • SHA1

    10ecc2c74e1bfa53e5aeaf0e7363cd299b8e2263

  • SHA256

    9f35e7c5a02f30bdde73e1ac97b9f45e755e722887d4f6f21737d3fc4309e197

  • SHA512

    aa45de56876e257ee36e3e3f5fd862756f5f334d9710fb5342057701211695562868c78408e1075976a887b40f74fd37733a6504f174a1855336ecbb1f506f2a

  • SSDEEP

    6144:GYKfZo/eEoJ05TUdpMOUO7xWVoEf7liaUyzq0idLT3je/586763EApVAQHBuBNmd:GYKm/DoJ1MOUOEVoEf7oz53Tpn

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

74.208.74.92:8080

89.32.150.160:8080

80.240.141.141:7080

151.80.142.33:80

5.196.35.138:7080

200.58.171.51:80

81.213.215.216:50000

187.150.150.127:7080

149.62.173.247:8080

62.75.160.178:8080

170.84.133.72:8443

79.129.0.173:8080

181.29.101.13:8080

183.82.97.25:80

109.104.79.48:8080

201.199.93.30:443

159.203.204.126:8080

181.36.42.205:443

46.28.111.142:7080

178.249.187.151:8080

rsa_pubkey.plain

Targets

    • Target

      9f35e7c5a02f30bdde73e1ac97b9f45e755e722887d4f6f21737d3fc4309e197

    • Size

      346KB

    • MD5

      fd0e21bdbe19856ba45f049b2932d9f5

    • SHA1

      10ecc2c74e1bfa53e5aeaf0e7363cd299b8e2263

    • SHA256

      9f35e7c5a02f30bdde73e1ac97b9f45e755e722887d4f6f21737d3fc4309e197

    • SHA512

      aa45de56876e257ee36e3e3f5fd862756f5f334d9710fb5342057701211695562868c78408e1075976a887b40f74fd37733a6504f174a1855336ecbb1f506f2a

    • SSDEEP

      6144:GYKfZo/eEoJ05TUdpMOUO7xWVoEf7liaUyzq0idLT3je/586763EApVAQHBuBNmd:GYKm/DoJ1MOUOEVoEf7oz53Tpn

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks