General

  • Target

    8034f8d9d57d65e9f8eb210520bdd017_icedid_JC.exe

  • Size

    284KB

  • Sample

    230824-r89lgaeg6w

  • MD5

    8034f8d9d57d65e9f8eb210520bdd017

  • SHA1

    d1c962d265c0c600b027a8b546f305e4f7e14716

  • SHA256

    e04c79aa606200b9c91067336949c1d23c7cc7fa1536308f1f86594db6e97bfd

  • SHA512

    72ed6adcc76b2fbc4d6792283d43ecb5a10d0d66962e4c98480e615321295ce340500b0e1f77555b22c79a32cbf8dad945af39767ba1c6049841a4c03126bd16

  • SSDEEP

    6144:XMgkpFbrMj/YtECiHhCdSHyo112tRvzkZa:PkpF7WCdStUp

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

72.143.73.234:443

162.241.140.129:8080

104.131.123.136:443

5.196.108.189:8080

62.75.141.82:80

76.175.162.101:80

130.0.132.242:80

79.137.83.50:443

104.131.44.150:8080

109.74.5.95:8080

121.7.31.214:80

176.111.60.55:8080

172.104.97.173:8080

61.19.246.238:443

47.144.21.12:443

110.142.236.207:80

181.169.235.7:80

123.176.25.234:80

185.94.252.104:443

108.46.29.236:80

rsa_pubkey.plain

Targets

    • Target

      8034f8d9d57d65e9f8eb210520bdd017_icedid_JC.exe

    • Size

      284KB

    • MD5

      8034f8d9d57d65e9f8eb210520bdd017

    • SHA1

      d1c962d265c0c600b027a8b546f305e4f7e14716

    • SHA256

      e04c79aa606200b9c91067336949c1d23c7cc7fa1536308f1f86594db6e97bfd

    • SHA512

      72ed6adcc76b2fbc4d6792283d43ecb5a10d0d66962e4c98480e615321295ce340500b0e1f77555b22c79a32cbf8dad945af39767ba1c6049841a4c03126bd16

    • SSDEEP

      6144:XMgkpFbrMj/YtECiHhCdSHyo112tRvzkZa:PkpF7WCdStUp

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks