Resubmissions

29-07-2023 04:16

230729-ev7hqsah27 10

29-07-2023 04:16

230729-ev281sbe7t 10

28-07-2023 18:29

230728-w5en5sgf37 10

General

  • Target

    c5e06a4b5bb840ex_JC.exe

  • Size

    262KB

  • Sample

    230729-ev7hqsah27

  • MD5

    c5e06a4b5bb8405acda4dabb99536291

  • SHA1

    d91b9e8c2645746a735c909fb298f23797157ac8

  • SHA256

    d270723b72eb71b721d1b7ec77667f3f799e5069b65971ef360292cd43c67b7c

  • SHA512

    4548c1d8042f47cc5c1240c1ebb68234a25684cb5a82f7578b5f49c963b2fde9e8fefd3a3567ba9a122b1dc129560235b1c3db95c99fde500a89cf13a30af0ec

  • SSDEEP

    6144:YzxQjP1gLp2i2NBYW2e42sqW9dl4e4tU5:Yzgi2NBY9XpYU5

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

80.11.158.65:8080

91.236.4.234:443

190.147.137.153:443

192.241.143.52:8080

149.62.173.247:8080

190.17.195.202:80

77.55.211.77:8080

70.32.115.157:8080

83.169.21.32:7080

190.229.148.144:80

175.114.178.83:443

46.214.11.172:80

172.104.169.32:8080

70.32.84.74:8080

170.81.48.2:80

113.190.254.245:80

118.69.71.14:80

203.25.159.3:8080

190.47.227.130:80

177.139.131.143:443

rsa_pubkey.plain

Targets

    • Target

      c5e06a4b5bb840ex_JC.exe

    • Size

      262KB

    • MD5

      c5e06a4b5bb8405acda4dabb99536291

    • SHA1

      d91b9e8c2645746a735c909fb298f23797157ac8

    • SHA256

      d270723b72eb71b721d1b7ec77667f3f799e5069b65971ef360292cd43c67b7c

    • SHA512

      4548c1d8042f47cc5c1240c1ebb68234a25684cb5a82f7578b5f49c963b2fde9e8fefd3a3567ba9a122b1dc129560235b1c3db95c99fde500a89cf13a30af0ec

    • SSDEEP

      6144:YzxQjP1gLp2i2NBYW2e42sqW9dl4e4tU5:Yzgi2NBY9XpYU5

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Matrix

Tasks