General

  • Target

    623abb334894076ccea662fcbd609408

  • Size

    283KB

  • Sample

    240117-krzavacack

  • MD5

    623abb334894076ccea662fcbd609408

  • SHA1

    b15088a1701fa72ede58461964df7304817a6358

  • SHA256

    e8c71144850a30c06dd3735bbe4d3f9456bcea54facba36b36e15cbb2e53b1a8

  • SHA512

    1b96c62c048f39c1b934c1a5f87ac6fdfe50db0932ed1322a2d5218873297bf066f91c18b75a58fd3e59194db7ccc0b78d49d958a4036f1f7b8fee6f1a94faba

  • SSDEEP

    6144:nJzrn0Fmcf1E+pBvYXuze9+p7swVVBKnuQGi4MQ:nNI1E+pBXe9+vrcZ4D

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

49.205.182.134:80

72.229.97.235:80

188.165.214.98:8080

185.201.9.197:8080

64.207.182.168:8080

5.39.91.110:7080

155.186.9.160:80

24.178.90.49:80

157.245.99.39:8080

174.118.202.24:443

50.246.154.69:80

79.137.83.50:443

110.145.11.73:80

190.29.166.0:80

176.111.60.55:8080

24.69.65.8:8080

46.105.131.79:8080

62.30.7.67:443

172.125.40.123:80

209.141.54.221:7080

rsa_pubkey.plain

Targets

    • Target

      623abb334894076ccea662fcbd609408

    • Size

      283KB

    • MD5

      623abb334894076ccea662fcbd609408

    • SHA1

      b15088a1701fa72ede58461964df7304817a6358

    • SHA256

      e8c71144850a30c06dd3735bbe4d3f9456bcea54facba36b36e15cbb2e53b1a8

    • SHA512

      1b96c62c048f39c1b934c1a5f87ac6fdfe50db0932ed1322a2d5218873297bf066f91c18b75a58fd3e59194db7ccc0b78d49d958a4036f1f7b8fee6f1a94faba

    • SSDEEP

      6144:nJzrn0Fmcf1E+pBvYXuze9+p7swVVBKnuQGi4MQ:nNI1E+pBXe9+vrcZ4D

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks