General

  • Target

    7347dc119209f43fe364941ff874795e_icedid_JC.exe

  • Size

    280KB

  • Sample

    230822-x1flbafa36

  • MD5

    7347dc119209f43fe364941ff874795e

  • SHA1

    bb2a4c7face9970c8077b719474a2307a3492172

  • SHA256

    dcc91db7c6d3534f1c3285097bc37c0469159867cb67b79dc9635451ae86d66e

  • SHA512

    5ac370c1a5347ecae47f8399dd8edac1ac216089d658247f43f3185d7804a1235ddbfc8d09cd9d0709b1545deae2b5ce22ebbbd932f92990b70aef79519a61bc

  • SSDEEP

    6144:kZVatxXzZ9nHZHKqgTOFsVf3b8v8Y8p7k:ptxXznVKssVf40Pk

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

104.193.103.61:80

104.131.123.136:443

5.196.108.189:8080

121.124.124.40:7080

87.106.139.101:8080

213.196.135.145:80

50.35.17.13:80

38.18.235.242:80

24.43.32.186:80

82.80.155.43:80

103.86.49.11:8080

113.61.66.94:80

24.137.76.62:80

187.49.206.134:80

42.200.107.142:80

24.179.13.119:80

93.147.212.206:80

108.46.29.236:80

105.186.233.33:80

37.139.21.175:8080

rsa_pubkey.plain

Targets

    • Target

      7347dc119209f43fe364941ff874795e_icedid_JC.exe

    • Size

      280KB

    • MD5

      7347dc119209f43fe364941ff874795e

    • SHA1

      bb2a4c7face9970c8077b719474a2307a3492172

    • SHA256

      dcc91db7c6d3534f1c3285097bc37c0469159867cb67b79dc9635451ae86d66e

    • SHA512

      5ac370c1a5347ecae47f8399dd8edac1ac216089d658247f43f3185d7804a1235ddbfc8d09cd9d0709b1545deae2b5ce22ebbbd932f92990b70aef79519a61bc

    • SSDEEP

      6144:kZVatxXzZ9nHZHKqgTOFsVf3b8v8Y8p7k:ptxXznVKssVf40Pk

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks