General

  • Target

    3c47fbdca4c59cc30a8e817595ba04d8_icedid_JC.exe

  • Size

    476KB

  • Sample

    230819-pj6r6sbc3x

  • MD5

    3c47fbdca4c59cc30a8e817595ba04d8

  • SHA1

    af68a000b4cc579cd973ce863235bed9785d1f00

  • SHA256

    b70c34da40026e8ea79a257072a5dfed07656978d5168bc81c6743bf5208980f

  • SHA512

    1dba960b723019baf7f2c85d8fb9b318dd5720ba6ced88782a2cdfa8b40b5fa16be0f2cb481d5194569b17f766a68a15e2db57c80817bda48361858469600fc7

  • SSDEEP

    12288:BWqXcbOaLlwAVZ1bAxUCIEBLcmacsitPbD5bZ4zc:UjBL2AdAxUCb5vft

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

125.200.20.233:80

93.186.197.189:7080

188.166.220.180:7080

192.175.111.217:7080

118.243.83.70:80

103.80.51.61:8080

185.80.172.199:80

172.96.190.154:8080

116.202.10.123:8080

46.105.131.68:8080

223.17.215.76:80

192.210.217.94:8080

190.194.12.132:80

115.79.59.157:80

190.191.171.72:80

24.231.51.190:80

203.153.216.178:7080

175.103.38.146:80

36.91.44.183:80

213.165.178.214:80

rsa_pubkey.plain

Targets

    • Target

      3c47fbdca4c59cc30a8e817595ba04d8_icedid_JC.exe

    • Size

      476KB

    • MD5

      3c47fbdca4c59cc30a8e817595ba04d8

    • SHA1

      af68a000b4cc579cd973ce863235bed9785d1f00

    • SHA256

      b70c34da40026e8ea79a257072a5dfed07656978d5168bc81c6743bf5208980f

    • SHA512

      1dba960b723019baf7f2c85d8fb9b318dd5720ba6ced88782a2cdfa8b40b5fa16be0f2cb481d5194569b17f766a68a15e2db57c80817bda48361858469600fc7

    • SSDEEP

      12288:BWqXcbOaLlwAVZ1bAxUCIEBLcmacsitPbD5bZ4zc:UjBL2AdAxUCb5vft

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

    • Dave packer

      Detects executable using a packer named 'Dave' by the community, based on a string at the end.

MITRE ATT&CK Matrix

Tasks