General

  • Target

    01a668422dbc34fd1a6e5ad29ef0126b5be02d7674aaaee0079c4a56a1a4f174

  • Size

    1.1MB

  • Sample

    230519-yh2lhaae9s

  • MD5

    b647dde7ffee5537b8e8041e1956ebe1

  • SHA1

    26398568f431965cb3579ba037c1242d6d9ef33d

  • SHA256

    01a668422dbc34fd1a6e5ad29ef0126b5be02d7674aaaee0079c4a56a1a4f174

  • SHA512

    99e4a73ed343bcac51dd081953ba6b512cfd7d2ff560f61195f57165bad9a181b0422e44c45b7cadd9021f37fcac5f43798ab548bd7a675f6dd3a8532b23ebfe

  • SSDEEP

    12288:fyNCEl9Db0oBnySXcAnXPKxz1fjR+hyB9x+yKUOK+KDSaRBzdYEfY8CMQBvEs1yN:fC7NRXP2rRkY+uO1WSEnXfYB7vEs1yN

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

118.243.83.70:80

5.189.168.53:8080

162.241.41.111:7080

190.85.46.52:7080

95.216.205.155:8080

50.116.78.109:8080

54.38.143.245:8080

113.160.248.110:80

115.176.16.221:80

223.17.215.76:80

202.188.218.82:80

172.96.190.154:8080

139.59.12.63:8080

181.95.133.104:80

74.208.173.91:8080

202.166.170.43:80

185.142.236.163:443

198.57.203.63:8080

185.86.148.68:443

88.247.58.26:80

rsa_pubkey.plain

Targets

    • Target

      01a668422dbc34fd1a6e5ad29ef0126b5be02d7674aaaee0079c4a56a1a4f174

    • Size

      1.1MB

    • MD5

      b647dde7ffee5537b8e8041e1956ebe1

    • SHA1

      26398568f431965cb3579ba037c1242d6d9ef33d

    • SHA256

      01a668422dbc34fd1a6e5ad29ef0126b5be02d7674aaaee0079c4a56a1a4f174

    • SHA512

      99e4a73ed343bcac51dd081953ba6b512cfd7d2ff560f61195f57165bad9a181b0422e44c45b7cadd9021f37fcac5f43798ab548bd7a675f6dd3a8532b23ebfe

    • SSDEEP

      12288:fyNCEl9Db0oBnySXcAnXPKxz1fjR+hyB9x+yKUOK+KDSaRBzdYEfY8CMQBvEs1yN:fC7NRXP2rRkY+uO1WSEnXfYB7vEs1yN

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks