General

  • Target

    71a376d74dfd6141deb206de33608f31

  • Size

    283KB

  • Sample

    231226-qjty2shgd9

  • MD5

    71a376d74dfd6141deb206de33608f31

  • SHA1

    c8dd54a036a01066c3fd8d35a6e1305cea9b56de

  • SHA256

    5ca65d1b81432fe56aad60a8a2b5a12fff00619ef015fcec3dc200e4e11e78b2

  • SHA512

    7c5e6a4bd77b37a513046b6c8f8ee9365d50207621ba70b6c3329b60b83e799b332c737750110d9944424f299ccd23cb3f740bd5d2160e91fb33341a7c18e0b6

  • SSDEEP

    6144:nJzrn0Fmcf1E+pBvYXuze9+37swVVBKnuQGi4MQ:nNI1E+pBXe9+drcZ4D

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

49.205.182.134:80

72.229.97.235:80

188.165.214.98:8080

185.201.9.197:8080

64.207.182.168:8080

5.39.91.110:7080

155.186.9.160:80

24.178.90.49:80

157.245.99.39:8080

174.118.202.24:443

50.246.154.69:80

79.137.83.50:443

110.145.11.73:80

190.29.166.0:80

176.111.60.55:8080

24.69.65.8:8080

46.105.131.79:8080

62.30.7.67:443

172.125.40.123:80

209.141.54.221:7080

rsa_pubkey.plain

Targets

    • Target

      71a376d74dfd6141deb206de33608f31

    • Size

      283KB

    • MD5

      71a376d74dfd6141deb206de33608f31

    • SHA1

      c8dd54a036a01066c3fd8d35a6e1305cea9b56de

    • SHA256

      5ca65d1b81432fe56aad60a8a2b5a12fff00619ef015fcec3dc200e4e11e78b2

    • SHA512

      7c5e6a4bd77b37a513046b6c8f8ee9365d50207621ba70b6c3329b60b83e799b332c737750110d9944424f299ccd23cb3f740bd5d2160e91fb33341a7c18e0b6

    • SSDEEP

      6144:nJzrn0Fmcf1E+pBvYXuze9+37swVVBKnuQGi4MQ:nNI1E+pBXe9+drcZ4D

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks