General

  • Target

    002d5fc16b4a7fb22d6c18a706774d12de50658f936116f0f8842b4e0c47bede

  • Size

    216KB

  • Sample

    230519-xvc81afe23

  • MD5

    d8d3349451145cc1f5bd111e1d599594

  • SHA1

    de4df787916ef5902eed7fcbece0db5169cdd20f

  • SHA256

    002d5fc16b4a7fb22d6c18a706774d12de50658f936116f0f8842b4e0c47bede

  • SHA512

    e76236d1cdc7300e0eb28b97ad0468c701bf3c1ccfb6c0adb2408d3c852e2579b1b8213ba2f4e5eeace1a0d81534dea4db6f2f5c93b721f0d2044a33136a954f

  • SSDEEP

    6144:RntoY1FllBLC5p3Y4hd1+S3NdQBE8klubGoU:RtoY1FllBiNY4hdsS9v8kMU

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

67.163.161.107:80

107.170.146.252:8080

173.212.214.235:7080

167.114.153.111:8080

185.94.252.104:443

110.142.236.207:80

194.187.133.160:443

218.147.193.146:80

172.104.97.173:8080

216.139.123.119:80

50.91.114.38:80

202.134.4.211:8080

113.61.66.94:80

139.99.158.11:443

62.171.142.179:8080

37.139.21.175:8080

190.108.228.27:443

94.23.237.171:443

154.91.33.137:443

201.241.127.190:80

rsa_pubkey.plain

Targets

    • Target

      002d5fc16b4a7fb22d6c18a706774d12de50658f936116f0f8842b4e0c47bede

    • Size

      216KB

    • MD5

      d8d3349451145cc1f5bd111e1d599594

    • SHA1

      de4df787916ef5902eed7fcbece0db5169cdd20f

    • SHA256

      002d5fc16b4a7fb22d6c18a706774d12de50658f936116f0f8842b4e0c47bede

    • SHA512

      e76236d1cdc7300e0eb28b97ad0468c701bf3c1ccfb6c0adb2408d3c852e2579b1b8213ba2f4e5eeace1a0d81534dea4db6f2f5c93b721f0d2044a33136a954f

    • SSDEEP

      6144:RntoY1FllBLC5p3Y4hd1+S3NdQBE8klubGoU:RtoY1FllBiNY4hdsS9v8kMU

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks