General

  • Target

    S0bv40qIFZYpb8iaDdll.dll

  • Size

    524KB

  • Sample

    230630-sxe36aef6x

  • MD5

    1d4ddbdad72718e58e0adcc0fc133f80

  • SHA1

    b8dc219295c27c1b7366097bebfeb46d1546b170

  • SHA256

    f1837d93609bd3716203efbab53b6049d6d6735dead3e8ebde21b8ad3babcda8

  • SHA512

    ba8950ac6d1e966c8547c8fdac7a865430a103e1b49d1aed6118ec1d215218317d272e95f3d3e0c57255051a11e1ae9aebede623343d8a67f98154e129758bff

  • SSDEEP

    12288:F4UuFuNB2bvR0Iva6qREvKMHBM8i/Da7VpxmIXf5:FriuNsVC6qss/g5

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

54.37.212.235:80

45.15.23.184:443

41.76.108.46:8080

212.237.5.209:443

46.55.222.11:443

207.38.84.195:8080

103.8.26.102:8080

138.185.72.26:8080

104.251.214.46:8080

110.232.117.186:8080

51.68.175.8:8080

176.104.106.96:8080

216.158.226.206:443

103.8.26.103:8080

103.75.201.2:443

210.57.217.132:8080

195.154.133.20:443

45.142.114.231:8080

107.182.225.142:8080

158.69.222.101:443

eck1.plain
ecs1.plain

Targets

    • Target

      S0bv40qIFZYpb8iaDdll.dll

    • Size

      524KB

    • MD5

      1d4ddbdad72718e58e0adcc0fc133f80

    • SHA1

      b8dc219295c27c1b7366097bebfeb46d1546b170

    • SHA256

      f1837d93609bd3716203efbab53b6049d6d6735dead3e8ebde21b8ad3babcda8

    • SHA512

      ba8950ac6d1e966c8547c8fdac7a865430a103e1b49d1aed6118ec1d215218317d272e95f3d3e0c57255051a11e1ae9aebede623343d8a67f98154e129758bff

    • SSDEEP

      12288:F4UuFuNB2bvR0Iva6qREvKMHBM8i/Da7VpxmIXf5:FriuNsVC6qss/g5

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Matrix

Tasks