General

  • Target

    359fe0d7084c4e7084d92adab7ce7f9a2f520cbfb411cb41892d0ef654ee4fed

  • Size

    296KB

  • Sample

    230804-ej2s4sad8s

  • MD5

    a2d9e507715673be3509269f337939f8

  • SHA1

    65c25db59d5e1c8cf0c6d58ee497698677b6ae14

  • SHA256

    359fe0d7084c4e7084d92adab7ce7f9a2f520cbfb411cb41892d0ef654ee4fed

  • SHA512

    f04a03622ca17014d8ba11cbbbd5369ed1103aa48e554a171143ee68223f8e45914fbb040e24f700e2e903faa6f4456017d57afc154f8a331c4273a25a4b52c4

  • SSDEEP

    6144:zLTQdXfZ1XRcD6aJbHBZHfIXc5fmZ7tm0eg8vQ:zfEXfZ1aD6aJbh7q7tm0ePv

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

12.30.50.130:80

120.138.30.150:8080

139.59.67.118:443

94.23.216.33:80

70.121.172.89:80

139.130.242.43:80

83.169.36.251:8080

89.205.113.80:80

24.137.76.62:80

201.173.217.124:443

87.106.136.232:8080

173.62.217.22:443

78.24.219.147:8080

190.55.181.54:443

85.152.162.105:80

24.179.13.119:80

139.59.60.244:8080

95.179.229.244:8080

162.241.242.173:8080

137.119.36.33:80

rsa_pubkey.plain

Targets

    • Target

      359fe0d7084c4e7084d92adab7ce7f9a2f520cbfb411cb41892d0ef654ee4fed

    • Size

      296KB

    • MD5

      a2d9e507715673be3509269f337939f8

    • SHA1

      65c25db59d5e1c8cf0c6d58ee497698677b6ae14

    • SHA256

      359fe0d7084c4e7084d92adab7ce7f9a2f520cbfb411cb41892d0ef654ee4fed

    • SHA512

      f04a03622ca17014d8ba11cbbbd5369ed1103aa48e554a171143ee68223f8e45914fbb040e24f700e2e903faa6f4456017d57afc154f8a331c4273a25a4b52c4

    • SSDEEP

      6144:zLTQdXfZ1XRcD6aJbHBZHfIXc5fmZ7tm0eg8vQ:zfEXfZ1aD6aJbh7q7tm0ePv

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks