General

  • Target

    374566f47b30eb3ee8d4e258a4b779e1_icedid_JC.exe

  • Size

    460KB

  • Sample

    230818-vh7kzacb79

  • MD5

    374566f47b30eb3ee8d4e258a4b779e1

  • SHA1

    e08c927a868075b148c0c44ef00840d973da35b5

  • SHA256

    14498c590981c0228b90eae8974291dfb5201150a55dd677ec14a36faa3b6b80

  • SHA512

    886821aa9c2fdc6c806dc4609efca3a03b2659f5af44e536bef2036f15da46e56e1950250ea3ff9d2df8aa373bfbed565c12a8d7591128fdc9b4d2946f95dd89

  • SSDEEP

    12288:Z/AvbGAY1eDGULbJ3rOhkfq8eKYmC3LC2:WvbRY1gZb2ywLC2

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

88.153.35.32:80

107.170.146.252:8080

173.212.214.235:7080

167.114.153.111:8080

67.170.250.203:443

121.124.124.40:7080

103.86.49.11:8080

74.214.230.200:80

194.187.133.160:443

172.104.97.173:8080

172.91.208.86:80

200.116.145.225:443

202.134.4.216:8080

172.105.13.66:443

190.164.104.62:80

50.35.17.13:80

176.111.60.55:8080

201.241.127.190:80

66.76.12.94:8080

95.213.236.64:8080

rsa_pubkey.plain

Targets

    • Target

      374566f47b30eb3ee8d4e258a4b779e1_icedid_JC.exe

    • Size

      460KB

    • MD5

      374566f47b30eb3ee8d4e258a4b779e1

    • SHA1

      e08c927a868075b148c0c44ef00840d973da35b5

    • SHA256

      14498c590981c0228b90eae8974291dfb5201150a55dd677ec14a36faa3b6b80

    • SHA512

      886821aa9c2fdc6c806dc4609efca3a03b2659f5af44e536bef2036f15da46e56e1950250ea3ff9d2df8aa373bfbed565c12a8d7591128fdc9b4d2946f95dd89

    • SSDEEP

      12288:Z/AvbGAY1eDGULbJ3rOhkfq8eKYmC3LC2:WvbRY1gZb2ywLC2

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks