General

  • Target

    NA_NA_NA_78734e54a44955exeex_JC.exe

  • Size

    384KB

  • Sample

    230725-vzzxfsfa3s

  • MD5

    78734e54a449550cf80b8697fa5a188c

  • SHA1

    7158f3f6fd55dbe707cad152d9010e529fc5d39f

  • SHA256

    afd70e634d56d16e45a45041387c01db055c194c92ab6da87d70ceadb6e78982

  • SHA512

    0c0d9d3b9534bc7f3e70af850658894c933baaaae277e89de810549248e93621c9fffc2a96a5df0ed3c67178f11e9643ce80f9444626412d65b62ed1aacb6d14

  • SSDEEP

    6144:lwzBxdxO1bx5hFU2iO10zCJV8NRTamLcvf1iB10rhQvUBg8uQf4nv:lwtY1bxTi2iYocV8OBPrGvUBgVQM

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

169.0.200.83:80

113.163.216.135:80

94.23.62.116:8080

98.103.204.12:443

59.148.253.194:8080

80.15.100.37:80

172.86.186.21:8080

12.163.208.58:80

181.61.182.143:80

216.47.196.104:80

62.84.75.50:80

181.30.61.163:443

181.120.29.49:80

60.93.23.51:80

45.46.37.97:80

82.76.111.249:443

81.214.253.80:443

181.58.181.9:80

111.67.12.221:8080

104.131.41.185:8080

rsa_pubkey.plain

Targets

    • Target

      NA_NA_NA_78734e54a44955exeex_JC.exe

    • Size

      384KB

    • MD5

      78734e54a449550cf80b8697fa5a188c

    • SHA1

      7158f3f6fd55dbe707cad152d9010e529fc5d39f

    • SHA256

      afd70e634d56d16e45a45041387c01db055c194c92ab6da87d70ceadb6e78982

    • SHA512

      0c0d9d3b9534bc7f3e70af850658894c933baaaae277e89de810549248e93621c9fffc2a96a5df0ed3c67178f11e9643ce80f9444626412d65b62ed1aacb6d14

    • SSDEEP

      6144:lwzBxdxO1bx5hFU2iO10zCJV8NRTamLcvf1iB10rhQvUBg8uQf4nv:lwtY1bxTi2iYocV8OBPrGvUBgVQM

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks