General

  • Target

    0c37754aa8f73ae35bac7d63387ebaa38ba2d5b133fd87e78e13fe11e56295ba.bin.bin

  • Size

    101KB

  • Sample

    230511-w7fn8abd8t

  • MD5

    19d348cc489a13650ef2d851d80e0e93

  • SHA1

    731fbf8c1efc0feab19204fcd32075a5d2f61aa9

  • SHA256

    0c37754aa8f73ae35bac7d63387ebaa38ba2d5b133fd87e78e13fe11e56295ba

  • SHA512

    d21172645a56ba78bae9a38a78182cc81f4725fe6b3af40b501527308628853ed74532cad11d136f90d23b9ced5ad7cbe905fbd32c48196478d30629808e428e

  • SSDEEP

    3072:mLjsXANkR/fkfdWolI9AiDrV8MNBYahBxMGLnVK+vM:mslR/fURcAiDrV81ahBxMcKf

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

189.189.56.216:443

76.69.29.42:80

51.255.165.160:8080

45.56.79.249:443

163.172.40.218:7080

89.188.124.145:443

212.71.237.140:8080

154.120.227.206:8080

190.146.131.105:8080

45.79.95.107:443

181.36.42.205:443

139.5.237.27:443

46.41.151.103:8080

77.245.101.134:8080

190.182.161.7:8080

201.190.133.235:8080

68.183.190.199:8080

69.163.33.84:8080

109.169.86.13:8080

190.96.118.15:443

rsa_pubkey.plain

Targets

    • Target

      0c37754aa8f73ae35bac7d63387ebaa38ba2d5b133fd87e78e13fe11e56295ba.bin.bin

    • Size

      101KB

    • MD5

      19d348cc489a13650ef2d851d80e0e93

    • SHA1

      731fbf8c1efc0feab19204fcd32075a5d2f61aa9

    • SHA256

      0c37754aa8f73ae35bac7d63387ebaa38ba2d5b133fd87e78e13fe11e56295ba

    • SHA512

      d21172645a56ba78bae9a38a78182cc81f4725fe6b3af40b501527308628853ed74532cad11d136f90d23b9ced5ad7cbe905fbd32c48196478d30629808e428e

    • SSDEEP

      3072:mLjsXANkR/fkfdWolI9AiDrV8MNBYahBxMGLnVK+vM:mslR/fURcAiDrV81ahBxMcKf

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks