General

  • Target

    effects915.exe

  • Size

    288KB

  • Sample

    230522-vsq1zabf34

  • MD5

    28bfff6a2933781a3d23dac2d4ddbbf7

  • SHA1

    e70bafa223c58212ffda30a652dde5fa0c108065

  • SHA256

    0766329f73128257dcc645d12cca3896b524d170c4bc69fbc998952d9ee9b67d

  • SHA512

    bf6f605d50e9f4273573f852851acefcb16b3a18c38ee014a0087861750291040edef7fdecafd472093fd0ccd489b1d8f160111479c14ab1f19a27dd40f7c5d5

  • SSDEEP

    6144:kY70Z8kCSgjTT0iZjyHbUrruN2u5m2I4EbdX:kjgjX0iZO8rm5m5HF

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

82.137.29.8:80

180.232.111.30:80

111.67.12.222:8080

94.23.62.116:8080

59.148.253.194:8080

212.71.237.140:8080

177.23.7.151:80

70.32.84.74:8080

94.176.234.118:443

185.183.16.47:80

12.162.84.2:8080

137.74.106.111:7080

5.89.33.136:80

37.187.161.206:8080

80.15.100.37:80

80.249.176.206:80

45.33.77.42:8080

62.84.75.50:80

68.183.170.114:8080

105.209.235.113:8080

rsa_pubkey.plain

Targets

    • Target

      effects915.exe

    • Size

      288KB

    • MD5

      28bfff6a2933781a3d23dac2d4ddbbf7

    • SHA1

      e70bafa223c58212ffda30a652dde5fa0c108065

    • SHA256

      0766329f73128257dcc645d12cca3896b524d170c4bc69fbc998952d9ee9b67d

    • SHA512

      bf6f605d50e9f4273573f852851acefcb16b3a18c38ee014a0087861750291040edef7fdecafd472093fd0ccd489b1d8f160111479c14ab1f19a27dd40f7c5d5

    • SSDEEP

      6144:kY70Z8kCSgjTT0iZjyHbUrruN2u5m2I4EbdX:kjgjX0iZO8rm5m5HF

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks