General

  • Target

    bd77b7ae25b641fbe75d38a84376cbffffbff1f53fe933ab60933b8f23eaba1c

  • Size

    184KB

  • Sample

    230307-wz42vaaf4w

  • MD5

    a4660fd493bb201ea13b07bfe400561c

  • SHA1

    37b5ee3f716f40d693510e23807ffda6822d07b8

  • SHA256

    bd77b7ae25b641fbe75d38a84376cbffffbff1f53fe933ab60933b8f23eaba1c

  • SHA512

    c1f2b05c3002e319f91c743dbdcc0e55b785aed6318c475855c55f7278410f951dc4d7f56304d78f9a57fcba25a760039164c771cb89c555fe04431ff7da10bd

  • SSDEEP

    1536:bpDIQIlQIlQIlQIlQIlQIlQIlQIlQIlQI45qGtVh/cVQ/9cEczE72eQLtKzGgcF:4GUVPEIEqLtpgcF

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

173.81.218.65:80

45.55.36.51:443

91.83.93.99:7080

45.55.219.163:443

169.239.182.217:8080

24.43.99.75:80

78.24.219.147:8080

95.179.229.244:8080

107.5.122.110:80

47.144.21.12:443

204.197.146.48:80

139.99.158.11:443

190.160.53.126:80

74.120.55.163:80

74.109.108.202:80

47.146.117.214:80

104.236.246.93:8080

174.137.65.18:80

41.60.200.34:80

209.141.54.221:8080

rsa_pubkey.plain

Targets

    • Target

      bd77b7ae25b641fbe75d38a84376cbffffbff1f53fe933ab60933b8f23eaba1c

    • Size

      184KB

    • MD5

      a4660fd493bb201ea13b07bfe400561c

    • SHA1

      37b5ee3f716f40d693510e23807ffda6822d07b8

    • SHA256

      bd77b7ae25b641fbe75d38a84376cbffffbff1f53fe933ab60933b8f23eaba1c

    • SHA512

      c1f2b05c3002e319f91c743dbdcc0e55b785aed6318c475855c55f7278410f951dc4d7f56304d78f9a57fcba25a760039164c771cb89c555fe04431ff7da10bd

    • SSDEEP

      1536:bpDIQIlQIlQIlQIlQIlQIlQIlQIlQIlQI45qGtVh/cVQ/9cEczE72eQLtKzGgcF:4GUVPEIEqLtpgcF

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Tasks