General

  • Target

    a230056eee199f661c7baeb61c349291_icedid_JC.exe

  • Size

    448KB

  • Sample

    230826-qwsxhscd7x

  • MD5

    a230056eee199f661c7baeb61c349291

  • SHA1

    e4fc9b8441023042b58d091b18d1b7097ee55fc7

  • SHA256

    8c50d8a6c0f296a90d110154edb696119f6b094560c2df3467c35fa2f8e19e88

  • SHA512

    2a3c0ca09b96af29699a639ab28abac02e6197215f9fb28c4a0c930bb371a151d9a6e02dfceee3c48146e44acc46a53bf850ec9951d6bcc569c0bd33c943141d

  • SSDEEP

    12288:Qq1UJp78SeNo712DLO2REPKZy0P2uM40Tz4:nCT7dRYDXZy0P2uMlTz4

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

72.143.73.234:443

162.241.140.129:8080

104.131.123.136:443

5.196.108.189:8080

62.75.141.82:80

76.175.162.101:80

130.0.132.242:80

79.137.83.50:443

104.131.44.150:8080

109.74.5.95:8080

121.7.31.214:80

176.111.60.55:8080

172.104.97.173:8080

61.19.246.238:443

47.144.21.12:443

110.142.236.207:80

181.169.235.7:80

123.176.25.234:80

185.94.252.104:443

108.46.29.236:80

rsa_pubkey.plain

Targets

    • Target

      a230056eee199f661c7baeb61c349291_icedid_JC.exe

    • Size

      448KB

    • MD5

      a230056eee199f661c7baeb61c349291

    • SHA1

      e4fc9b8441023042b58d091b18d1b7097ee55fc7

    • SHA256

      8c50d8a6c0f296a90d110154edb696119f6b094560c2df3467c35fa2f8e19e88

    • SHA512

      2a3c0ca09b96af29699a639ab28abac02e6197215f9fb28c4a0c930bb371a151d9a6e02dfceee3c48146e44acc46a53bf850ec9951d6bcc569c0bd33c943141d

    • SSDEEP

      12288:Qq1UJp78SeNo712DLO2REPKZy0P2uM40Tz4:nCT7dRYDXZy0P2uMlTz4

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks