General

  • Target

    4107fc8d98f532aac7332be1c476cb75_icedid_JC.exe

  • Size

    460KB

  • Sample

    230819-qslc9sad26

  • MD5

    4107fc8d98f532aac7332be1c476cb75

  • SHA1

    654710f65c0dfedd300d362b60a073277dcb45af

  • SHA256

    cc866bf5f12ce6c768b7a8f90368b81538fb0460ff8c4df0f763f6308dc8a117

  • SHA512

    d5bac0f7db39b3953be41e31159d9e542536252758b17628ee3d0de714686f0f009664b948a4991e1e4366a70ab16435e3923b719b3dea45954814b1a89febf8

  • SSDEEP

    12288:XOps+brP/VgjVbKirOhkfq8eKYmC3LC2:Us+vPN0byywLC2

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

88.153.35.32:80

107.170.146.252:8080

173.212.214.235:7080

167.114.153.111:8080

67.170.250.203:443

121.124.124.40:7080

103.86.49.11:8080

74.214.230.200:80

194.187.133.160:443

172.104.97.173:8080

172.91.208.86:80

200.116.145.225:443

202.134.4.216:8080

172.105.13.66:443

190.164.104.62:80

50.35.17.13:80

176.111.60.55:8080

201.241.127.190:80

66.76.12.94:8080

95.213.236.64:8080

rsa_pubkey.plain

Targets

    • Target

      4107fc8d98f532aac7332be1c476cb75_icedid_JC.exe

    • Size

      460KB

    • MD5

      4107fc8d98f532aac7332be1c476cb75

    • SHA1

      654710f65c0dfedd300d362b60a073277dcb45af

    • SHA256

      cc866bf5f12ce6c768b7a8f90368b81538fb0460ff8c4df0f763f6308dc8a117

    • SHA512

      d5bac0f7db39b3953be41e31159d9e542536252758b17628ee3d0de714686f0f009664b948a4991e1e4366a70ab16435e3923b719b3dea45954814b1a89febf8

    • SSDEEP

      12288:XOps+brP/VgjVbKirOhkfq8eKYmC3LC2:Us+vPN0byywLC2

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks