General

  • Target

    739a1b52745367f002baa977084e5273_icedid_JC.exe

  • Size

    456KB

  • Sample

    230822-x39beafa57

  • MD5

    739a1b52745367f002baa977084e5273

  • SHA1

    f2754ac2d978d89873fac73186287055bf879d8e

  • SHA256

    69391a5c3d15c2689bb29622243015e782f1bcb722851ba0dbcb0ad7ff9de252

  • SHA512

    d68ef5336a7fd92d2c1518384ce35f52ee2529efeef7262b5eeaeba0f07524cc859aa3921778cd382983cb411cf6c2c9c0a8ca4df97512ab630068de42cb2664

  • SSDEEP

    12288:vVIsyDV7GQaTSrQIo9Jx3w8n/vEhZhRg:6syZ7flrOPEQ

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

78.206.229.130:80

104.131.92.244:8080

70.39.251.94:8080

87.230.25.43:8080

79.118.74.90:80

82.76.111.249:443

82.76.52.155:80

212.71.237.140:8080

188.251.213.180:80

103.236.179.162:80

1.226.84.243:8080

70.32.84.74:8080

2.84.12.98:80

201.213.177.139:80

177.73.0.98:443

170.81.48.2:80

129.232.220.11:8080

177.144.130.105:8080

213.52.74.198:80

120.72.18.91:80

rsa_pubkey.plain

Targets

    • Target

      739a1b52745367f002baa977084e5273_icedid_JC.exe

    • Size

      456KB

    • MD5

      739a1b52745367f002baa977084e5273

    • SHA1

      f2754ac2d978d89873fac73186287055bf879d8e

    • SHA256

      69391a5c3d15c2689bb29622243015e782f1bcb722851ba0dbcb0ad7ff9de252

    • SHA512

      d68ef5336a7fd92d2c1518384ce35f52ee2529efeef7262b5eeaeba0f07524cc859aa3921778cd382983cb411cf6c2c9c0a8ca4df97512ab630068de42cb2664

    • SSDEEP

      12288:vVIsyDV7GQaTSrQIo9Jx3w8n/vEhZhRg:6syZ7flrOPEQ

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks