General

  • Target

    NA_NA_3f80ca9ca0e195exeexe_JC.exe

  • Size

    292KB

  • Sample

    230724-qsmw4aeb3z

  • MD5

    3f80ca9ca0e195e25d1cc002288ab559

  • SHA1

    fc6e7ce0ec75d2e31eb0b4134bbcd29268a34da9

  • SHA256

    a6c21c890529ed7ecede27d7f9e11c87e0318e413c3951e0f68f5cc9545231e8

  • SHA512

    e8f479ca742e1b29a821a5fb753786cdced942b244c2e2606baeaf9c6a42aa363dcba850bb88c390a4077f76445b16e48643f5a515f3baac34ae895d605b8b80

  • SSDEEP

    6144:6yzieSRy6+iYL4leSYwGR7kcjskLViAhbONkoC5b:67rRy6+i2Eel37UkLkAwN7C

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

24.69.65.8:8080

74.128.121.17:80

64.207.182.168:8080

51.89.36.180:443

51.89.199.141:8080

208.74.26.234:80

112.185.64.233:80

98.150.169.135:80

115.94.207.99:443

203.153.216.189:7080

2.58.16.89:8080

12.184.217.101:80

202.134.4.216:8080

109.116.245.80:80

110.145.101.66:443

95.9.5.93:80

104.32.141.43:80

190.146.92.48:80

139.162.60.124:8080

187.161.206.24:80

rsa_pubkey.plain

Targets

    • Target

      NA_NA_3f80ca9ca0e195exeexe_JC.exe

    • Size

      292KB

    • MD5

      3f80ca9ca0e195e25d1cc002288ab559

    • SHA1

      fc6e7ce0ec75d2e31eb0b4134bbcd29268a34da9

    • SHA256

      a6c21c890529ed7ecede27d7f9e11c87e0318e413c3951e0f68f5cc9545231e8

    • SHA512

      e8f479ca742e1b29a821a5fb753786cdced942b244c2e2606baeaf9c6a42aa363dcba850bb88c390a4077f76445b16e48643f5a515f3baac34ae895d605b8b80

    • SSDEEP

      6144:6yzieSRy6+iYL4leSYwGR7kcjskLViAhbONkoC5b:67rRy6+i2Eel37UkLkAwN7C

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks