General

  • Target

    6nSnnpp8aZzkTcEj8wAkHLI.dll

  • Size

    822KB

  • Sample

    230630-pv43qabh77

  • MD5

    8b19548a0084cf4d0b17145ae60a57bd

  • SHA1

    9f4f9cf116450d076041b3138beea450eeb1431a

  • SHA256

    b79cf1b3552070359bffcb2d5a144259c1d5db86eced22765ba7c35dcf2eb090

  • SHA512

    642ffd689beceb113cf554b380a52a882bffc4a39ba6c5ea56e33e04a1b3b60fe89b57681daecc7b14f012d0ae66b33af28de08b80712e32edd7c13a0020635a

  • SSDEEP

    6144:v7rc6Wk6SYnaKOai5uWLwrd0jSjc0vNPqBVzLFW7WUPV2m7hzS7583Tg7A+++ncE:vXcFk6SYna2Frd0jSjcc9SpmBZX0TMh

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

149.56.131.28:8080

72.15.201.15:8080

207.148.79.14:8080

82.165.152.127:8080

46.55.222.11:443

213.241.20.155:443

163.44.196.120:8080

51.254.140.238:7080

107.170.39.149:8080

188.44.20.25:443

82.223.21.224:8080

172.104.251.154:8080

164.68.99.3:8080

101.50.0.91:8080

129.232.188.93:443

173.212.193.249:8080

103.132.242.26:8080

186.194.240.217:443

37.187.115.122:8080

91.207.28.33:8080

eck1.plain
ecs1.plain

Targets

    • Target

      6nSnnpp8aZzkTcEj8wAkHLI.dll

    • Size

      822KB

    • MD5

      8b19548a0084cf4d0b17145ae60a57bd

    • SHA1

      9f4f9cf116450d076041b3138beea450eeb1431a

    • SHA256

      b79cf1b3552070359bffcb2d5a144259c1d5db86eced22765ba7c35dcf2eb090

    • SHA512

      642ffd689beceb113cf554b380a52a882bffc4a39ba6c5ea56e33e04a1b3b60fe89b57681daecc7b14f012d0ae66b33af28de08b80712e32edd7c13a0020635a

    • SSDEEP

      6144:v7rc6Wk6SYnaKOai5uWLwrd0jSjc0vNPqBVzLFW7WUPV2m7hzS7583Tg7A+++ncE:vXcFk6SYna2Frd0jSjcc9SpmBZX0TMh

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Matrix

Tasks