General

  • Target

    e63a8490d6753b60773f3328faab14b2db2147d6924cf243551b7560693c1f55

  • Size

    362KB

  • Sample

    230804-kcc43aab59

  • MD5

    25cfeafcd9a2716d5bac85dc6882f149

  • SHA1

    5e47c52b1f61127cadcbc8dcc6834d2906fda972

  • SHA256

    e63a8490d6753b60773f3328faab14b2db2147d6924cf243551b7560693c1f55

  • SHA512

    8f5297b2a7e9f999ce57c5bbd3551b2c8a9407f0c7a2eb190634b8d0c56a51546b22b610efcc882f64a2a712b97444fc0f43c5bd12dd8aea8b4dfb0d055334ff

  • SSDEEP

    6144:Qd6cOQxFhNAup/iZXANH9KOhntU1JJxtRvgxZG4TxO9E0tFtTT2:QQup6Zs7M1rSRTk9E0ftTT

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

68.44.137.144:443

69.30.203.214:8080

67.205.85.243:8080

79.98.24.39:8080

5.196.74.210:8080

188.83.220.2:443

109.116.214.124:443

203.117.253.142:80

104.131.11.150:443

97.82.79.83:80

121.124.124.40:7080

83.169.36.251:8080

89.186.91.200:443

70.167.215.250:8080

204.197.146.48:80

167.86.90.214:8080

190.160.53.126:80

95.213.236.64:8080

47.144.21.12:443

169.239.182.217:8080

rsa_pubkey.plain

Targets

    • Target

      e63a8490d6753b60773f3328faab14b2db2147d6924cf243551b7560693c1f55

    • Size

      362KB

    • MD5

      25cfeafcd9a2716d5bac85dc6882f149

    • SHA1

      5e47c52b1f61127cadcbc8dcc6834d2906fda972

    • SHA256

      e63a8490d6753b60773f3328faab14b2db2147d6924cf243551b7560693c1f55

    • SHA512

      8f5297b2a7e9f999ce57c5bbd3551b2c8a9407f0c7a2eb190634b8d0c56a51546b22b610efcc882f64a2a712b97444fc0f43c5bd12dd8aea8b4dfb0d055334ff

    • SSDEEP

      6144:Qd6cOQxFhNAup/iZXANH9KOhntU1JJxtRvgxZG4TxO9E0tFtTT2:QQup6Zs7M1rSRTk9E0ftTT

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks