General

  • Target

    3dcf025c922a4e89e25de9f4cd4c7326_icedid_JC.exe

  • Size

    460KB

  • Sample

    230819-pv9cfabd8t

  • MD5

    3dcf025c922a4e89e25de9f4cd4c7326

  • SHA1

    c0ba6f39eded0c212e0d4e9a7d7bf31a40d0ba31

  • SHA256

    5a5c3b3b544a1acc8be3089710cd4c425436c162473d7617fe17cd0d7adb9f97

  • SHA512

    5e2e53f1dd1afd2ad6c79c4011a531360df2c545d3260cfeb0f6879538c5c747415a6c8638cf4d957e9f4914fb13a218e132c1132b002e123768b2ef1ae172e6

  • SSDEEP

    12288:6cZtNelTZ/zGzfbMMrOhkfq8eKYmC3LC2:/tN0TZb8bKywLC2

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

88.153.35.32:80

107.170.146.252:8080

173.212.214.235:7080

167.114.153.111:8080

67.170.250.203:443

121.124.124.40:7080

103.86.49.11:8080

74.214.230.200:80

194.187.133.160:443

172.104.97.173:8080

172.91.208.86:80

200.116.145.225:443

202.134.4.216:8080

172.105.13.66:443

190.164.104.62:80

50.35.17.13:80

176.111.60.55:8080

201.241.127.190:80

66.76.12.94:8080

95.213.236.64:8080

rsa_pubkey.plain

Targets

    • Target

      3dcf025c922a4e89e25de9f4cd4c7326_icedid_JC.exe

    • Size

      460KB

    • MD5

      3dcf025c922a4e89e25de9f4cd4c7326

    • SHA1

      c0ba6f39eded0c212e0d4e9a7d7bf31a40d0ba31

    • SHA256

      5a5c3b3b544a1acc8be3089710cd4c425436c162473d7617fe17cd0d7adb9f97

    • SHA512

      5e2e53f1dd1afd2ad6c79c4011a531360df2c545d3260cfeb0f6879538c5c747415a6c8638cf4d957e9f4914fb13a218e132c1132b002e123768b2ef1ae172e6

    • SSDEEP

      12288:6cZtNelTZ/zGzfbMMrOhkfq8eKYmC3LC2:/tN0TZb8bKywLC2

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks