General

  • Target

    0047969b91d7f1a385d2cf87b483a7eb9bc743865e027df58946fbfe4a3b82b4

  • Size

    385KB

  • Sample

    230612-v848jadg2z

  • MD5

    fd094f8ffdab2e4e6556a9670aa17ae2

  • SHA1

    1ce5fd0b5551a80e0ba7675ea0e23351ca1c8f97

  • SHA256

    0047969b91d7f1a385d2cf87b483a7eb9bc743865e027df58946fbfe4a3b82b4

  • SHA512

    77bbf06b7d0d5828a55c5ddb32def35a19a5e34edaa6d8d7ff119ff29ad0fc429effb75b747f0dc70a6920d5881908aaa76ed93128a2b71b8af79bc747c2e4fd

  • SSDEEP

    6144:1t4Xih2c4kgqdzXPv8+LfXXML0zM43VXmQIrCvaEP8nQZ1Sd1:16qdrPPDo0zM43VOrdEPn7Sd1

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

88.119.191.111:80

139.5.101.203:80

195.159.28.244:8080

50.116.78.109:8080

178.62.254.156:8080

179.5.118.12:80

198.20.228.9:8080

78.90.78.210:80

188.226.165.170:8080

46.32.229.152:8080

58.27.215.3:8080

162.144.145.58:8080

190.194.12.132:80

175.103.38.146:80

185.208.226.142:8080

139.59.12.63:8080

178.254.36.182:8080

116.202.10.123:8080

192.163.221.191:8080

157.7.164.178:8081

rsa_pubkey.plain

Targets

    • Target

      0047969b91d7f1a385d2cf87b483a7eb9bc743865e027df58946fbfe4a3b82b4

    • Size

      385KB

    • MD5

      fd094f8ffdab2e4e6556a9670aa17ae2

    • SHA1

      1ce5fd0b5551a80e0ba7675ea0e23351ca1c8f97

    • SHA256

      0047969b91d7f1a385d2cf87b483a7eb9bc743865e027df58946fbfe4a3b82b4

    • SHA512

      77bbf06b7d0d5828a55c5ddb32def35a19a5e34edaa6d8d7ff119ff29ad0fc429effb75b747f0dc70a6920d5881908aaa76ed93128a2b71b8af79bc747c2e4fd

    • SSDEEP

      6144:1t4Xih2c4kgqdzXPv8+LfXXML0zM43VXmQIrCvaEP8nQZ1Sd1:16qdrPPDo0zM43VOrdEPn7Sd1

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks