General

  • Target

    4da2827ce3f839ec9553ed43f8d930fb

  • Size

    745KB

  • Sample

    240109-hm5kyshacr

  • MD5

    4da2827ce3f839ec9553ed43f8d930fb

  • SHA1

    983e5f288040931bff241a9633889a7ba32a46d4

  • SHA256

    d6d347e6a73691e86122c143754923b7bfeec9ffaf5c24406324457c1d547098

  • SHA512

    ea3e7483e63ad730bad6897a19043f0e038c4eaa5a23ebac92bb1e3c7d7c1d65ccdbd1674bfa49df059c6fa884187311f7d7cc64a1908bcf68774c7cfec04ee7

  • SSDEEP

    12288:P1iuahDbW+ePQKTguan8z/SbGvfqepaLPvzp8AxNyYVcdYn2ntlJ0i3lA:P1iuUXAQK8ulSbGvUntbyYVcdYoE

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

1.215.28.101:8080

184.167.148.162:80

66.25.34.20:80

165.227.156.155:443

167.99.105.223:7080

67.225.179.64:8080

176.31.200.130:8080

190.220.19.82:443

91.242.138.5:443

159.65.25.128:8080

61.197.110.214:80

110.143.84.202:80

95.128.43.213:8080

91.73.197.90:80

201.184.105.242:443

108.179.206.219:8080

181.57.193.14:80

188.152.7.140:80

139.130.241.252:443

197.254.221.174:80

rsa_pubkey.plain

Targets

    • Target

      4da2827ce3f839ec9553ed43f8d930fb

    • Size

      745KB

    • MD5

      4da2827ce3f839ec9553ed43f8d930fb

    • SHA1

      983e5f288040931bff241a9633889a7ba32a46d4

    • SHA256

      d6d347e6a73691e86122c143754923b7bfeec9ffaf5c24406324457c1d547098

    • SHA512

      ea3e7483e63ad730bad6897a19043f0e038c4eaa5a23ebac92bb1e3c7d7c1d65ccdbd1674bfa49df059c6fa884187311f7d7cc64a1908bcf68774c7cfec04ee7

    • SSDEEP

      12288:P1iuahDbW+ePQKTguan8z/SbGvfqepaLPvzp8AxNyYVcdYn2ntlJ0i3lA:P1iuUXAQK8ulSbGvUntbyYVcdYoE

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks