General

  • Target

    005720e9f897ebb44c338900c9148ec3e04806c1d55399718dbf630f8710f7ca

  • Size

    385KB

  • Sample

    230522-xe9l9scg9v

  • MD5

    a13c8160a77ee732d505cacaf64ce930

  • SHA1

    d1ef1356b19e99381e7bd2064bbf85aa9f319bd3

  • SHA256

    005720e9f897ebb44c338900c9148ec3e04806c1d55399718dbf630f8710f7ca

  • SHA512

    c19032b3da37e0b9366f2e2f6f25f4977c637d5cc38b172ed83e1c3397f7aad4be563632a125f14f73c10ff858a8f5f3de1c36511e82a7f18c1067ef16925215

  • SSDEEP

    6144:it4XJh2c4kgKO0mUv8+LfXXMrUzM43IGQePKTQqEP90/0eeBpT:ibKO0TPDIUzM43IkKDEP90/7ev

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

49.205.182.134:80

72.229.97.235:80

188.165.214.98:8080

185.201.9.197:8080

64.207.182.168:8080

5.39.91.110:7080

155.186.9.160:80

24.178.90.49:80

157.245.99.39:8080

174.118.202.24:443

50.246.154.69:80

79.137.83.50:443

110.145.11.73:80

190.29.166.0:80

176.111.60.55:8080

24.69.65.8:8080

46.105.131.79:8080

62.30.7.67:443

172.125.40.123:80

209.141.54.221:7080

rsa_pubkey.plain

Targets

    • Target

      005720e9f897ebb44c338900c9148ec3e04806c1d55399718dbf630f8710f7ca

    • Size

      385KB

    • MD5

      a13c8160a77ee732d505cacaf64ce930

    • SHA1

      d1ef1356b19e99381e7bd2064bbf85aa9f319bd3

    • SHA256

      005720e9f897ebb44c338900c9148ec3e04806c1d55399718dbf630f8710f7ca

    • SHA512

      c19032b3da37e0b9366f2e2f6f25f4977c637d5cc38b172ed83e1c3397f7aad4be563632a125f14f73c10ff858a8f5f3de1c36511e82a7f18c1067ef16925215

    • SSDEEP

      6144:it4XJh2c4kgKO0mUv8+LfXXMrUzM43IGQePKTQqEP90/0eeBpT:ibKO0TPDIUzM43IkKDEP90/7ev

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks