General

  • Target

    5c1eb2104efddbf6dd8ec89fb57df5d7

  • Size

    348KB

  • Sample

    240115-eym89shcan

  • MD5

    5c1eb2104efddbf6dd8ec89fb57df5d7

  • SHA1

    4e190accabaefbc887b11b9e21d56accbdacd775

  • SHA256

    09fc36c979db3d6f456c9b00982bfda8cc08516bc9bdb59fed72e458001d0a64

  • SHA512

    11b20c6004d09f5374bee0f2b5d6a9ab224915c3fa1ebbf75b65cdb5f1e279628ce8933668cbbf6325649fb9006dcfdf28294ef8f22a857831be82fbdd41f297

  • SSDEEP

    6144:RhUemQcYyGKa0qXpZ/vexQ+y3mrUZPJ3hgNhAuoEiaN:dyU0Qd+GmJhbH

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

81.213.175.132:80

79.118.72.250:80

172.245.248.239:8080

54.36.185.60:80

202.79.24.136:443

82.208.149.146:80

190.114.254.163:8080

186.146.13.184:443

170.81.48.2:80

177.144.130.105:443

190.251.216.100:80

113.163.216.135:80

192.232.229.53:4143

190.45.24.210:80

70.32.84.74:8080

51.255.165.160:8080

103.236.179.162:80

81.214.253.80:443

62.84.75.50:80

74.58.215.226:80

rsa_pubkey.plain

Targets

    • Target

      5c1eb2104efddbf6dd8ec89fb57df5d7

    • Size

      348KB

    • MD5

      5c1eb2104efddbf6dd8ec89fb57df5d7

    • SHA1

      4e190accabaefbc887b11b9e21d56accbdacd775

    • SHA256

      09fc36c979db3d6f456c9b00982bfda8cc08516bc9bdb59fed72e458001d0a64

    • SHA512

      11b20c6004d09f5374bee0f2b5d6a9ab224915c3fa1ebbf75b65cdb5f1e279628ce8933668cbbf6325649fb9006dcfdf28294ef8f22a857831be82fbdd41f297

    • SSDEEP

      6144:RhUemQcYyGKa0qXpZ/vexQ+y3mrUZPJ3hgNhAuoEiaN:dyU0Qd+GmJhbH

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks