General

  • Target

    652194b60ed8d125763a56d43c94362f_icedid_JC.exe

  • Size

    268KB

  • Sample

    230821-wqbzpsgf61

  • MD5

    652194b60ed8d125763a56d43c94362f

  • SHA1

    a973fda3b9802ea5e6e6e1700dc8912426d49e82

  • SHA256

    31df957666f0b7c3b9602b1ae8a13ee2aceedf8b8a8f90105e67dbcc097a190b

  • SHA512

    f2eedceb1823609bd4f99984d813817e775f2b6749b9f3f7c9f74da30306b74afbe52baff0575941b747dbe015d1a2bf03b8ae038d0cb0a6c22042cd4b34c30a

  • SSDEEP

    3072:r5XcTfcrVXLbezrMM2grlVkDKl8yytsHK4lzIZqnhbvMJ4aiiiiHiiiiiiiiiii1:AfQm8M2IlVAttndZqxBjH4BB3K

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

12.184.217.101:80

98.150.169.135:80

51.89.36.180:443

64.207.182.168:8080

51.89.199.141:8080

62.171.142.179:8080

27.114.9.93:80

94.200.114.161:80

24.230.141.169:80

190.162.215.233:80

85.105.111.166:80

168.235.67.138:7080

110.142.236.207:80

67.170.250.203:443

184.180.181.202:80

109.116.245.80:80

94.23.237.171:443

76.175.162.101:80

108.46.29.236:80

157.245.99.39:8080

rsa_pubkey.plain

Targets

    • Target

      652194b60ed8d125763a56d43c94362f_icedid_JC.exe

    • Size

      268KB

    • MD5

      652194b60ed8d125763a56d43c94362f

    • SHA1

      a973fda3b9802ea5e6e6e1700dc8912426d49e82

    • SHA256

      31df957666f0b7c3b9602b1ae8a13ee2aceedf8b8a8f90105e67dbcc097a190b

    • SHA512

      f2eedceb1823609bd4f99984d813817e775f2b6749b9f3f7c9f74da30306b74afbe52baff0575941b747dbe015d1a2bf03b8ae038d0cb0a6c22042cd4b34c30a

    • SSDEEP

      3072:r5XcTfcrVXLbezrMM2grlVkDKl8yytsHK4lzIZqnhbvMJ4aiiiiHiiiiiiiiiii1:AfQm8M2IlVAttndZqxBjH4BB3K

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks