General

  • Target

    65032a67ff49aa29cae7b14e52cc3553

  • Size

    768KB

  • Sample

    240118-k225gsgeaq

  • MD5

    65032a67ff49aa29cae7b14e52cc3553

  • SHA1

    ce4c415d435b2cd65f259bb272637accc9fb5a50

  • SHA256

    70a3adf80af0b883254bc2d3c75eab14200cf892c2e6a4a71729dfae2e7b84b9

  • SHA512

    d4c737d3fbe7eb11f53adb24b0721eaf3671b3369dc4fce83ad134dece9635344b2fb06365cec43e46e49ce6681646f50093c8f6623bd5ce9c5e55c2945b345a

  • SSDEEP

    12288:Ahwxo6AneWPv28guds4niVzjljBpaoFpqN8gK3H:rxo6AtnUuxnANpFpW8gK3

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

125.200.20.233:80

93.186.197.189:7080

188.166.220.180:7080

192.175.111.217:7080

118.243.83.70:80

103.80.51.61:8080

185.80.172.199:80

172.96.190.154:8080

116.202.10.123:8080

46.105.131.68:8080

223.17.215.76:80

192.210.217.94:8080

190.194.12.132:80

115.79.59.157:80

190.191.171.72:80

24.231.51.190:80

203.153.216.178:7080

175.103.38.146:80

36.91.44.183:80

213.165.178.214:80

rsa_pubkey.plain

Targets

    • Target

      65032a67ff49aa29cae7b14e52cc3553

    • Size

      768KB

    • MD5

      65032a67ff49aa29cae7b14e52cc3553

    • SHA1

      ce4c415d435b2cd65f259bb272637accc9fb5a50

    • SHA256

      70a3adf80af0b883254bc2d3c75eab14200cf892c2e6a4a71729dfae2e7b84b9

    • SHA512

      d4c737d3fbe7eb11f53adb24b0721eaf3671b3369dc4fce83ad134dece9635344b2fb06365cec43e46e49ce6681646f50093c8f6623bd5ce9c5e55c2945b345a

    • SSDEEP

      12288:Ahwxo6AneWPv28guds4niVzjljBpaoFpqN8gK3H:rxo6AtnUuxnANpFpW8gK3

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

    • Dave packer

      Detects executable using a packer named 'Dave' by the community, based on a string at the end.

MITRE ATT&CK Matrix

Tasks