General

  • Target

    25b5780c888a8eeb1260b0880efaebf6

  • Size

    432KB

  • Sample

    231231-dltd3seahl

  • MD5

    25b5780c888a8eeb1260b0880efaebf6

  • SHA1

    db3f28216aeeba8af51115d1fc799a2b6abd8c1f

  • SHA256

    8f8b165d03fb14c977d84409e9455933c58eece0fb7382321b8b9887ec4c22bb

  • SHA512

    034bb8aafe03364aab482978a3f5085f20e72756044ab8351882828411f7f51987f556c836af8fbd572ec646132aab44177b81f7e1f28daae5baa778baad37b8

  • SSDEEP

    12288:rkEjer16eQSqXL4m1EiOS1OrX3sBqCjM7cuJc5ViQjnbbyADuCgs:rk2E1kEi1asBqCM7SiQjbFuO

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

24.231.88.85:80

191.112.178.60:80

50.116.111.59:8080

173.249.20.233:443

188.165.214.98:8080

74.40.205.197:443

62.75.141.82:80

2.58.16.89:8080

188.219.31.12:80

95.213.236.64:8080

72.186.136.247:443

185.201.9.197:8080

203.153.216.189:7080

202.134.4.216:8080

72.229.97.235:80

24.179.13.119:80

174.118.202.24:443

74.208.45.104:8080

51.89.36.180:443

202.141.243.254:443

rsa_pubkey.plain

Targets

    • Target

      25b5780c888a8eeb1260b0880efaebf6

    • Size

      432KB

    • MD5

      25b5780c888a8eeb1260b0880efaebf6

    • SHA1

      db3f28216aeeba8af51115d1fc799a2b6abd8c1f

    • SHA256

      8f8b165d03fb14c977d84409e9455933c58eece0fb7382321b8b9887ec4c22bb

    • SHA512

      034bb8aafe03364aab482978a3f5085f20e72756044ab8351882828411f7f51987f556c836af8fbd572ec646132aab44177b81f7e1f28daae5baa778baad37b8

    • SSDEEP

      12288:rkEjer16eQSqXL4m1EiOS1OrX3sBqCjM7cuJc5ViQjnbbyADuCgs:rk2E1kEi1asBqCM7SiQjbFuO

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks