General

  • Target

    ce8aec9be4fbb67ef577cd30393bd8a16a2c7d4dcb9f69b847ffce807569a9ea

  • Size

    341KB

  • Sample

    230804-eg8hwaad7t

  • MD5

    b4b277fee09ceebdf38e8197407a7cfa

  • SHA1

    dacc5e3e945dc2559d17761c60268bd4606e4263

  • SHA256

    ce8aec9be4fbb67ef577cd30393bd8a16a2c7d4dcb9f69b847ffce807569a9ea

  • SHA512

    45fe324ac46b36fb01601e37721848b025a82c3a47fd522c3910249351a5125b1d1a4f1307e77dc635efc3300300a12815c84f457e9e324e8df8715736531659

  • SSDEEP

    6144:idJyYj3aZcfqbvLyRs+myvek1gg2TwzjeSbAHYrmf9dpQLzD:4aKfMmRAyvXgEiVYafbOP

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

221.147.142.214:80

188.40.170.197:80

51.38.50.144:8080

46.22.116.163:7080

190.151.5.131:443

58.27.215.3:8080

179.5.118.12:80

73.100.19.104:80

192.210.217.94:8080

192.163.221.191:8080

103.93.220.182:80

91.213.106.100:8080

190.192.39.136:80

115.79.59.157:80

190.164.135.81:80

91.83.93.103:443

188.166.220.180:7080

116.202.10.123:8080

36.91.44.183:80

77.74.78.80:443

rsa_pubkey.plain

Targets

    • Target

      ce8aec9be4fbb67ef577cd30393bd8a16a2c7d4dcb9f69b847ffce807569a9ea

    • Size

      341KB

    • MD5

      b4b277fee09ceebdf38e8197407a7cfa

    • SHA1

      dacc5e3e945dc2559d17761c60268bd4606e4263

    • SHA256

      ce8aec9be4fbb67ef577cd30393bd8a16a2c7d4dcb9f69b847ffce807569a9ea

    • SHA512

      45fe324ac46b36fb01601e37721848b025a82c3a47fd522c3910249351a5125b1d1a4f1307e77dc635efc3300300a12815c84f457e9e324e8df8715736531659

    • SSDEEP

      6144:idJyYj3aZcfqbvLyRs+myvek1gg2TwzjeSbAHYrmf9dpQLzD:4aKfMmRAyvXgEiVYafbOP

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks