General

  • Target

    0b28dc6f12d3b18d40afb250d8f20cfc8a85d05c77e86512c9f2f83ec8c3c225

  • Size

    652KB

  • Sample

    230519-ybmtrsae4z

  • MD5

    757b6e8f8643819e0405c48b041fae65

  • SHA1

    bd61c6e1892e465464a8ee74e0031f79bdeec548

  • SHA256

    0b28dc6f12d3b18d40afb250d8f20cfc8a85d05c77e86512c9f2f83ec8c3c225

  • SHA512

    a92effcc3aa2c52821da00b543b25603606c17e56c7ed02424e67ad1c36e74bab69d94236d1d054e93de4bc43166ed96757b8a77aa165b072ef5afc09355aab6

  • SSDEEP

    12288:/v2US3BEc0hCxUoBm6c+qrbCucwWHRJFfA++8L:GUSxEXhpl62rbDQRJFB

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

74.75.104.224:80

201.184.105.242:443

51.89.36.180:443

64.207.182.168:8080

51.89.199.141:8080

109.116.245.80:80

24.178.90.49:80

12.184.217.101:80

172.86.188.251:8080

217.20.166.178:7080

123.176.25.234:80

76.175.162.101:80

79.137.83.50:443

190.29.166.0:80

113.61.66.94:80

134.209.144.106:443

139.162.60.124:8080

108.46.29.236:80

182.208.30.18:443

88.153.35.32:80

rsa_pubkey.plain

Targets

    • Target

      0b28dc6f12d3b18d40afb250d8f20cfc8a85d05c77e86512c9f2f83ec8c3c225

    • Size

      652KB

    • MD5

      757b6e8f8643819e0405c48b041fae65

    • SHA1

      bd61c6e1892e465464a8ee74e0031f79bdeec548

    • SHA256

      0b28dc6f12d3b18d40afb250d8f20cfc8a85d05c77e86512c9f2f83ec8c3c225

    • SHA512

      a92effcc3aa2c52821da00b543b25603606c17e56c7ed02424e67ad1c36e74bab69d94236d1d054e93de4bc43166ed96757b8a77aa165b072ef5afc09355aab6

    • SSDEEP

      12288:/v2US3BEc0hCxUoBm6c+qrbCucwWHRJFfA++8L:GUSxEXhpl62rbDQRJFB

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks