General

  • Target

    illkVUA0aCB42y28qRyvY91Mq6.dll

  • Size

    848KB

  • Sample

    230630-pxcq9ada7y

  • MD5

    26bf9a27e1ae4680db6c0528579aa5d5

  • SHA1

    1c606018e5dc1bd2189b88216ea82c59f72449e9

  • SHA256

    7a2b948dfa606620068203247663247cb95c4a64fde2fa6e522a0a2828027352

  • SHA512

    d91d47ac63a24fed894e460e4d03fe2f23636d0f1a561f267007e0d1910424f437a3c8a38100c6b81c2824c50a76cc3c777158023608643f83c29545fcf6b2fb

  • SSDEEP

    12288:OBOHvWMwoyDdgp4W5dhdu1sRcwT8b3UHv8qDznxN6t:OX/RgaW5dhv8oHvbzn6

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

68.183.94.239:80

104.131.11.205:443

138.197.109.175:8080

187.84.80.182:443

79.143.187.147:443

216.158.226.206:443

167.99.115.35:8080

212.24.98.99:8080

1.234.21.73:7080

206.189.28.199:8080

158.69.222.101:443

164.68.99.3:8080

188.44.20.25:443

185.157.82.211:8080

134.122.66.193:8080

196.218.30.83:443

72.15.201.15:8080

5.9.116.246:8080

176.104.106.96:8080

153.126.146.25:7080

eck1.plain
ecs1.plain

Targets

    • Target

      illkVUA0aCB42y28qRyvY91Mq6.dll

    • Size

      848KB

    • MD5

      26bf9a27e1ae4680db6c0528579aa5d5

    • SHA1

      1c606018e5dc1bd2189b88216ea82c59f72449e9

    • SHA256

      7a2b948dfa606620068203247663247cb95c4a64fde2fa6e522a0a2828027352

    • SHA512

      d91d47ac63a24fed894e460e4d03fe2f23636d0f1a561f267007e0d1910424f437a3c8a38100c6b81c2824c50a76cc3c777158023608643f83c29545fcf6b2fb

    • SSDEEP

      12288:OBOHvWMwoyDdgp4W5dhdu1sRcwT8b3UHv8qDznxN6t:OX/RgaW5dhv8oHvbzn6

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks