General

  • Target

    5fc1bc6290d5628ea5bc51b458372900a21e9cace9ce34be0f0f09cf079ba3fb

  • Size

    172KB

  • Sample

    230804-p77z5sah88

  • MD5

    445d8eb0e21ac49119a7e13d5622ef0e

  • SHA1

    10d74acea2b6dd07c7500b0e407a35898dfdfafc

  • SHA256

    5fc1bc6290d5628ea5bc51b458372900a21e9cace9ce34be0f0f09cf079ba3fb

  • SHA512

    8b513b9456ce6702df014de5a5e9bcaa6d08d90c054aef8a8e8541835a6ca26bfae95d3ab3d80a3377f13556d50d88ed4b1d8b1f95b7059942de90da8309020b

  • SSDEEP

    3072:txHv+QU/iuiEM15FmoD4UG5kKgdOj5hNILXKS:txPkidn5/G5+8jPNIDK

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

45.16.226.117:443

91.121.54.71:8080

209.236.123.42:8080

89.32.150.160:8080

45.161.242.102:80

37.52.87.0:80

137.74.106.111:7080

71.197.211.156:80

217.199.160.224:7080

186.70.127.199:8090

50.28.51.143:8080

190.115.18.139:8080

85.105.140.135:443

24.148.98.177:80

181.30.61.163:443

192.241.146.84:8080

185.94.252.27:443

77.238.212.227:80

185.94.252.12:80

190.147.137.153:443

rsa_pubkey.plain

Targets

    • Target

      5fc1bc6290d5628ea5bc51b458372900a21e9cace9ce34be0f0f09cf079ba3fb

    • Size

      172KB

    • MD5

      445d8eb0e21ac49119a7e13d5622ef0e

    • SHA1

      10d74acea2b6dd07c7500b0e407a35898dfdfafc

    • SHA256

      5fc1bc6290d5628ea5bc51b458372900a21e9cace9ce34be0f0f09cf079ba3fb

    • SHA512

      8b513b9456ce6702df014de5a5e9bcaa6d08d90c054aef8a8e8541835a6ca26bfae95d3ab3d80a3377f13556d50d88ed4b1d8b1f95b7059942de90da8309020b

    • SSDEEP

      3072:txHv+QU/iuiEM15FmoD4UG5kKgdOj5hNILXKS:txPkidn5/G5+8jPNIDK

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Matrix

Tasks