General

  • Target

    TRwu8tfxztNty5tIogFjsKG.zip

  • Size

    873KB

  • Sample

    230308-lr8pysfb89

  • MD5

    64048e240c1db85470fcab72ef05b1ae

  • SHA1

    85226cf76a1a6b72bbdc146f1a535fb1ba891c94

  • SHA256

    fa3d349119a0d23573d2f35770da77e082ce3434934a6e98ed43696b40043761

  • SHA512

    26db698eab69be2f4b080e0546fc94c4054635829f7f4d94d8e8896c76db2e662d2ef022116035eba7f5c72bd9e69c4cf530af5e1b9b6c5a82b55308dc858095

  • SSDEEP

    12288:74DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sX:0evtlkdJe4m19Fgs

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

129.232.188.93:443

164.90.222.65:443

159.65.88.10:8080

172.105.226.75:8080

115.68.227.76:8080

187.63.160.88:80

169.57.156.166:8080

185.4.135.165:8080

153.126.146.25:7080

197.242.150.244:8080

139.59.126.41:443

186.194.240.217:443

103.132.242.26:8080

206.189.28.199:8080

163.44.196.120:8080

95.217.221.146:8080

159.89.202.34:443

119.59.103.152:8080

183.111.227.137:8080

201.94.166.162:443

eck1.plain
ecs1.plain

Targets

    • Target

      HA8eIaalRc0917mRoS19ZSz9zXs883.dll

    • Size

      537.7MB

    • MD5

      dca356e2f18ac61da1a8df6d78b0186a

    • SHA1

      d7c0b08b86d62e9d7af12b53fcd3db61dfa18510

    • SHA256

      70e9d80b287cec24d97ec11b5bb9a27c70e1e65004c21ea03407ebeddf5ffc03

    • SHA512

      227748a690beb7987ccb5f1071b673eadf03d7858c533a3af438540012e2f28ec90dff2917e25791cffb7041e2340a18126765b67d9a8aa51c1ba7fb767d0d9f

    • SSDEEP

      24576:4E4cLCJMj2C8c3wCRSNWiy/eK5xDegO82/gkU8jG:4GLCJMjl8c3wKwKXeZ

MITRE ATT&CK Enterprise v6

Tasks