General

  • Target

    NA_NA_NA_NA_aaf3d47e284e0cex_JC.exe

  • Size

    448KB

  • Sample

    230727-vd8x8sgh8x

  • MD5

    aaf3d47e284e0c48d2129fd37e723afc

  • SHA1

    8bd725b0ccd2f0131d1c2310126ce1a497a1fba3

  • SHA256

    0476635d1f953bd2b3073a936a5085eef81af9446336b04c70ae8d1c691622a3

  • SHA512

    531f57ebd57abef7c55ea4b6cafb5879cd8e6c4fce7cebe1f95d28fe6e3b9fa7bc0332747cecb5f58b03468cac32884e2d98ae9fff5c1ee59f95be2f17dbe001

  • SSDEEP

    12288:D6SCcim/8ocX7krc2vwegEPnCH3ZL8Ow:D6lc3sorcXF8Ow

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

174.118.202.24:443

192.232.229.54:7080

46.101.58.37:8080

37.187.161.206:8080

12.163.208.58:80

177.74.228.34:80

68.183.190.199:8080

212.71.237.140:8080

94.176.234.118:443

185.94.252.12:80

51.15.7.189:80

190.24.243.186:80

186.70.127.199:8090

60.93.23.51:80

149.202.72.142:7080

5.196.35.138:7080

45.33.77.42:8080

85.214.26.7:8080

83.169.21.32:7080

111.67.12.221:8080

rsa_pubkey.plain

Targets

    • Target

      NA_NA_NA_NA_aaf3d47e284e0cex_JC.exe

    • Size

      448KB

    • MD5

      aaf3d47e284e0c48d2129fd37e723afc

    • SHA1

      8bd725b0ccd2f0131d1c2310126ce1a497a1fba3

    • SHA256

      0476635d1f953bd2b3073a936a5085eef81af9446336b04c70ae8d1c691622a3

    • SHA512

      531f57ebd57abef7c55ea4b6cafb5879cd8e6c4fce7cebe1f95d28fe6e3b9fa7bc0332747cecb5f58b03468cac32884e2d98ae9fff5c1ee59f95be2f17dbe001

    • SSDEEP

      12288:D6SCcim/8ocX7krc2vwegEPnCH3ZL8Ow:D6lc3sorcXF8Ow

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks