General

  • Target

    2b5f70f3aeb59094ab81e6221b3b8a61_icedid_JC.exe

  • Size

    424KB

  • Sample

    230818-rvfq8sca9s

  • MD5

    2b5f70f3aeb59094ab81e6221b3b8a61

  • SHA1

    5616e242e2ca2b05b5bd08fa2dc58005eff66d45

  • SHA256

    16f1597a9670dd8eee6f1e6eb595d5cd0b50550889f5f2ccb680777590a506df

  • SHA512

    b0ce2716b10b1b69832e9689de00cb891df5ba445cb5f6c7c69cd78bb5dd0956133db80430d868f130d81f30d1321a178751e3512bdaaa0176a3e341ae488b67

  • SSDEEP

    6144:lsMGurR1A4h4lBwnCFkAF5jCULYYEhJaATdN4LFz++EPtMNLP4dO8WpKOa:WXuV1AtlKnujCY47TduRNEPddO8cK/

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

174.106.122.139:80

159.203.116.47:8080

173.249.6.108:443

104.236.246.93:8080

174.45.13.118:80

137.59.187.107:8080

94.200.114.161:80

37.187.72.193:8080

67.10.155.92:80

121.124.124.40:7080

24.43.99.75:80

75.139.38.211:80

109.74.5.95:8080

137.119.36.33:80

74.134.41.124:80

66.65.136.14:80

94.1.108.190:443

181.169.235.7:80

79.137.83.50:443

104.131.44.150:8080

rsa_pubkey.plain

Targets

    • Target

      2b5f70f3aeb59094ab81e6221b3b8a61_icedid_JC.exe

    • Size

      424KB

    • MD5

      2b5f70f3aeb59094ab81e6221b3b8a61

    • SHA1

      5616e242e2ca2b05b5bd08fa2dc58005eff66d45

    • SHA256

      16f1597a9670dd8eee6f1e6eb595d5cd0b50550889f5f2ccb680777590a506df

    • SHA512

      b0ce2716b10b1b69832e9689de00cb891df5ba445cb5f6c7c69cd78bb5dd0956133db80430d868f130d81f30d1321a178751e3512bdaaa0176a3e341ae488b67

    • SSDEEP

      6144:lsMGurR1A4h4lBwnCFkAF5jCULYYEhJaATdN4LFz++EPtMNLP4dO8WpKOa:WXuV1AtlKnujCY47TduRNEPddO8cK/

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks