General

  • Target

    03eadafcf2e1b300585ebab7864f5bbd92741af48a72b0de86656904dbd032f7

  • Size

    341KB

  • Sample

    230522-xv8d5sch7t

  • MD5

    1db81bd4e458e7befc81ea3f501cc3b9

  • SHA1

    cad4a466a89f8d2490e7120e302310fc7eff2cf6

  • SHA256

    03eadafcf2e1b300585ebab7864f5bbd92741af48a72b0de86656904dbd032f7

  • SHA512

    ba8974d18a8d55a96180a2d54afe40bef816c7c6bf96159b7a2cdcdc5f222abd01fd1ff448fc751c851f5cd05cf43c3eccfdcedfefd884159ea341fcc1833510

  • SSDEEP

    6144:FqT+5a/xBsa0T98E1YNmdezRXrjr6JFs7yHIRFa//m4hLmUVagW8uDnK1LFKK5BJ:0sa22aezRXrjrNpRFkCJDQL7BJ

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

181.58.181.9:80

190.251.216.100:80

54.36.185.60:80

202.79.24.136:443

111.67.12.222:8080

190.195.129.227:8090

12.162.84.2:8080

80.15.100.37:80

45.16.226.117:443

62.84.75.50:80

178.250.54.208:8080

188.135.15.49:80

103.236.179.162:80

181.120.29.49:80

68.183.170.114:8080

111.67.12.221:8080

197.232.36.108:80

185.183.16.47:80

94.23.62.116:8080

200.24.255.23:80

rsa_pubkey.plain

Targets

    • Target

      03eadafcf2e1b300585ebab7864f5bbd92741af48a72b0de86656904dbd032f7

    • Size

      341KB

    • MD5

      1db81bd4e458e7befc81ea3f501cc3b9

    • SHA1

      cad4a466a89f8d2490e7120e302310fc7eff2cf6

    • SHA256

      03eadafcf2e1b300585ebab7864f5bbd92741af48a72b0de86656904dbd032f7

    • SHA512

      ba8974d18a8d55a96180a2d54afe40bef816c7c6bf96159b7a2cdcdc5f222abd01fd1ff448fc751c851f5cd05cf43c3eccfdcedfefd884159ea341fcc1833510

    • SSDEEP

      6144:FqT+5a/xBsa0T98E1YNmdezRXrjr6JFs7yHIRFa//m4hLmUVagW8uDnK1LFKK5BJ:0sa22aezRXrjrNpRFkCJDQL7BJ

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks