General

  • Target

    02832599.exe

  • Size

    368KB

  • Sample

    230613-q4t5jsgh7z

  • MD5

    12e8a3a69cabfb6fd8da087b7f98d0c9

  • SHA1

    7a3a8de82411cd65051248c19d09042f69c15421

  • SHA256

    0be54293d07d7a4c917fc95c2c591e2524282de8319c105b518245e21596c3a5

  • SHA512

    9c89f3e4d049c2f70a47cf1d1e7d7942b2c9f455d6c84fa9b791f321b4cb94462c87c1a6873d0f7f6d5ab4d13cd7529fc0f51597bb62bfc7155d4167078f6417

  • SSDEEP

    6144:AozjUrx4KVHa9eUfTLHygDVjfML+YSet9Alyb57P/z6GcNdJ8lGn:AoiHV8zpYSe8lyRnzpcNdCM

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

78.90.78.210:80

188.226.165.170:8080

188.40.170.197:80

51.38.50.144:8080

120.51.34.254:80

85.246.78.192:80

139.59.12.63:8080

46.105.131.68:8080

5.2.246.108:80

60.108.128.186:80

190.55.186.229:80

47.154.85.229:80

188.80.27.54:80

115.79.59.157:80

91.75.75.46:80

119.92.77.17:80

109.13.179.195:80

190.151.5.131:443

5.79.70.250:8080

175.103.38.146:80

rsa_pubkey.plain

Targets

    • Target

      02832599.exe

    • Size

      368KB

    • MD5

      12e8a3a69cabfb6fd8da087b7f98d0c9

    • SHA1

      7a3a8de82411cd65051248c19d09042f69c15421

    • SHA256

      0be54293d07d7a4c917fc95c2c591e2524282de8319c105b518245e21596c3a5

    • SHA512

      9c89f3e4d049c2f70a47cf1d1e7d7942b2c9f455d6c84fa9b791f321b4cb94462c87c1a6873d0f7f6d5ab4d13cd7529fc0f51597bb62bfc7155d4167078f6417

    • SSDEEP

      6144:AozjUrx4KVHa9eUfTLHygDVjfML+YSet9Alyb57P/z6GcNdJ8lGn:AoiHV8zpYSe8lyRnzpcNdCM

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks