General

  • Target

    sVPPIR2.zip

  • Size

    962KB

  • Sample

    230324-p7gsysgd9x

  • MD5

    5aa10c455bf80876a73d570f679ec37f

  • SHA1

    77a21b3c59ca952f59db2a5dfb38b1bcd5cb9a54

  • SHA256

    ce6f43df2fa759f3c94bbd45b78c3d1bf55ac8dcbefa613643f2768adb3f411a

  • SHA512

    83078455017f392e12cc629094b6ff528660d28b266409d6f75bc5430babdb00a5e731509fbba324021c2ed7787c058ae330923c8aa7cf79657518b0b16db8e0

  • SSDEEP

    12288:Akf5dOzheNdckFRKluvnRHXdhbDHfXZX1EKdxKmSTH4deO:zXzNdfKluvnRHthzfoYxJld

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

213.239.212.5:443

129.232.188.93:443

103.43.75.120:443

197.242.150.244:8080

1.234.2.232:8080

110.232.117.186:8080

95.217.221.146:8080

159.89.202.34:443

159.65.88.10:8080

82.223.21.224:8080

169.57.156.166:8080

45.176.232.124:443

45.235.8.30:8080

173.212.193.249:8080

107.170.39.149:8080

119.59.103.152:8080

167.172.199.165:8080

91.207.28.33:8080

185.4.135.165:8080

104.168.155.143:8080

eck1.plain
ecs1.plain

Targets

    • Target

      2NeHelBNZtu0Ahifjd.dll

    • Size

      522.9MB

    • MD5

      f2628c5dce23002e36de9ef4868dd355

    • SHA1

      68ed54d8f41846e4ae6aa307db273a78366b19b2

    • SHA256

      439ea1f948d9fe110f5d72c5adf2cd96843bfef8214351f733f8ed92afefc24e

    • SHA512

      760fddc7777cc34432ba43768483342d6954ae3e6b013b06fc2f6bbac508bafd3a6517a490f5a642514d559d496f77a98c84542851e17ad8e3b8e17c16f51083

    • SSDEEP

      12288:6iWi2RszBxSICcO5w6SudYEW/N4HTJ4NYu3cX:4inOcO5wJVETHTJwYusX

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Tasks