General

  • Target

    ee596ee5b272255ed519b268fd04111d_icedid_JC.exe

  • Size

    268KB

  • Sample

    230830-yhcblsad78

  • MD5

    ee596ee5b272255ed519b268fd04111d

  • SHA1

    30c77c9ef727388d564506b2cd0820ff01aaea9d

  • SHA256

    d3094727983aafc5022694b55e32494b1c4992c1cf84e705365284df63ce3655

  • SHA512

    2c876fc8cc454720f668125f7ed0665700afb0f29ba4c88679546ee72ddc2b10926572c595e1c754638c6dff79715a719f49f213945fcf493b60e7b73af0e3dc

  • SSDEEP

    3072:hPp5mw6EHinF6vQS+JVKW+HYZtHK4lzIZqnhbvMJ4aiiiiHiiiiiiiiiiiiiiiiq:RmwKE4bJVKQKdZqxBjH4BB3K

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

12.184.217.101:80

98.150.169.135:80

51.89.36.180:443

64.207.182.168:8080

51.89.199.141:8080

62.171.142.179:8080

27.114.9.93:80

94.200.114.161:80

24.230.141.169:80

190.162.215.233:80

85.105.111.166:80

168.235.67.138:7080

110.142.236.207:80

67.170.250.203:443

184.180.181.202:80

109.116.245.80:80

94.23.237.171:443

76.175.162.101:80

108.46.29.236:80

157.245.99.39:8080

rsa_pubkey.plain

Targets

    • Target

      ee596ee5b272255ed519b268fd04111d_icedid_JC.exe

    • Size

      268KB

    • MD5

      ee596ee5b272255ed519b268fd04111d

    • SHA1

      30c77c9ef727388d564506b2cd0820ff01aaea9d

    • SHA256

      d3094727983aafc5022694b55e32494b1c4992c1cf84e705365284df63ce3655

    • SHA512

      2c876fc8cc454720f668125f7ed0665700afb0f29ba4c88679546ee72ddc2b10926572c595e1c754638c6dff79715a719f49f213945fcf493b60e7b73af0e3dc

    • SSDEEP

      3072:hPp5mw6EHinF6vQS+JVKW+HYZtHK4lzIZqnhbvMJ4aiiiiHiiiiiiiiiiiiiiiiq:RmwKE4bJVKQKdZqxBjH4BB3K

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks