General

  • Target

    NA_06680a92f2cec5exe_JC.exe

  • Size

    448KB

  • Sample

    230722-112qbsch3y

  • MD5

    06680a92f2cec52b55ad39450c1f4f7d

  • SHA1

    0b9382c4c8fc8bf9741d38200c071b36b8959e83

  • SHA256

    f9f1d824876f95f727a5288b33b47e0906f165e364bb02a29a78f5f0f32fa807

  • SHA512

    c6b9bdfa9bd7c5adb7728edefea0ddede6c02cc2ae91c803a4b033feb9304324c0b81f4d6ee0f07f05304b3186f37005f24a55161f14f5aa6ddaae5cef86af9b

  • SSDEEP

    12288:D6SCcim/8ocX7krc2TwegEPnCH3ZL8Ow:D6lc3sorc/F8Ow

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

174.118.202.24:443

192.232.229.54:7080

46.101.58.37:8080

37.187.161.206:8080

12.163.208.58:80

177.74.228.34:80

68.183.190.199:8080

212.71.237.140:8080

94.176.234.118:443

185.94.252.12:80

51.15.7.189:80

190.24.243.186:80

186.70.127.199:8090

60.93.23.51:80

149.202.72.142:7080

5.196.35.138:7080

45.33.77.42:8080

85.214.26.7:8080

83.169.21.32:7080

111.67.12.221:8080

rsa_pubkey.plain

Targets

    • Target

      NA_06680a92f2cec5exe_JC.exe

    • Size

      448KB

    • MD5

      06680a92f2cec52b55ad39450c1f4f7d

    • SHA1

      0b9382c4c8fc8bf9741d38200c071b36b8959e83

    • SHA256

      f9f1d824876f95f727a5288b33b47e0906f165e364bb02a29a78f5f0f32fa807

    • SHA512

      c6b9bdfa9bd7c5adb7728edefea0ddede6c02cc2ae91c803a4b033feb9304324c0b81f4d6ee0f07f05304b3186f37005f24a55161f14f5aa6ddaae5cef86af9b

    • SSDEEP

      12288:D6SCcim/8ocX7krc2TwegEPnCH3ZL8Ow:D6lc3sorc/F8Ow

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks