General

  • Target

    R7nqUDW5ZvC7NoyGobTe4Yhdo.dll

  • Size

    319KB

  • Sample

    230701-h4dtkafh87

  • MD5

    94c7b4a741db88185edc9265ec141973

  • SHA1

    927ff527f99c467c4de744ff2f6bf7cb909d52b3

  • SHA256

    f33201fb5c1ef6249c07835e159304b3f8c96e4c31a15ccd7782f8eca5af3241

  • SHA512

    5332ab787e15b3368d121df092c87df0c78163736bf2f2af93ace95d31d49a8853ccb5f8f0d4c1cb8bdf19343a9e4cc9d8acc3960ea8ac50e037020a6a1440a6

  • SSDEEP

    6144:0kpXoj6FsBVv5QMBvRxAVYyC1R4i+8O0YS4it9WFn5tkJvrtHBkb3+Y8rSVju0:0kpXoj6Fs7vlBvRmG4t0p4C9I5WHWb3e

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

101.50.0.91:8080

159.89.202.34:443

209.97.163.214:443

173.212.193.249:8080

159.65.88.10:8080

45.118.115.99:8080

82.165.152.127:8080

207.148.79.14:8080

41.73.252.195:443

196.218.30.83:443

103.75.201.2:443

64.227.100.222:8080

149.56.131.28:8080

103.43.75.120:443

188.44.20.25:443

185.4.135.165:8080

91.207.28.33:8080

110.232.117.186:8080

72.15.201.15:8080

45.176.232.124:443

eck1.plain
ecs1.plain

Targets

    • Target

      R7nqUDW5ZvC7NoyGobTe4Yhdo.dll

    • Size

      319KB

    • MD5

      94c7b4a741db88185edc9265ec141973

    • SHA1

      927ff527f99c467c4de744ff2f6bf7cb909d52b3

    • SHA256

      f33201fb5c1ef6249c07835e159304b3f8c96e4c31a15ccd7782f8eca5af3241

    • SHA512

      5332ab787e15b3368d121df092c87df0c78163736bf2f2af93ace95d31d49a8853ccb5f8f0d4c1cb8bdf19343a9e4cc9d8acc3960ea8ac50e037020a6a1440a6

    • SSDEEP

      6144:0kpXoj6FsBVv5QMBvRxAVYyC1R4i+8O0YS4it9WFn5tkJvrtHBkb3+Y8rSVju0:0kpXoj6Fs7vlBvRmG4t0p4C9I5WHWb3e

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Matrix

Tasks