General

  • Target

    7e514e8be48b0a1a597e7b2ca4e03d7e

  • Size

    271KB

  • Sample

    240128-3rlc4aegbr

  • MD5

    7e514e8be48b0a1a597e7b2ca4e03d7e

  • SHA1

    3379dee67ee82f7bf7022e67bb72a3c0428e5036

  • SHA256

    dcf227738d1c1d909553cd71ea2f058cdd0a867715dbe0cc4b974fad909a96cf

  • SHA512

    7e29c8fcbe0efb3d8b9b26593e5f53b628988e137be7fd8bfdfcc6e39628677d27b3714e2a76b9cd4619ab3bea3cc18085c51a082e0b52347a666ffcf57651ba

  • SSDEEP

    6144:+60EDP6uCLfGw/GpxXinM1BCo1PlumGx2mx2tXd0t115JGJ:X5DpBw/KViMTB1MnEWk0115JO

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

200.75.39.254:80

201.185.69.28:443

206.189.232.2:8080

138.197.99.250:8080

167.71.148.58:443

190.45.24.210:80

110.39.162.2:443

201.75.62.86:80

46.105.114.137:8080

190.247.139.101:80

59.148.253.194:8080

137.74.106.111:7080

202.79.24.136:443

177.85.167.10:80

80.15.100.37:80

45.16.226.117:443

190.24.243.186:80

138.97.60.141:7080

2.80.112.146:80

81.214.253.80:443

rsa_pubkey.plain

Targets

    • Target

      7e514e8be48b0a1a597e7b2ca4e03d7e

    • Size

      271KB

    • MD5

      7e514e8be48b0a1a597e7b2ca4e03d7e

    • SHA1

      3379dee67ee82f7bf7022e67bb72a3c0428e5036

    • SHA256

      dcf227738d1c1d909553cd71ea2f058cdd0a867715dbe0cc4b974fad909a96cf

    • SHA512

      7e29c8fcbe0efb3d8b9b26593e5f53b628988e137be7fd8bfdfcc6e39628677d27b3714e2a76b9cd4619ab3bea3cc18085c51a082e0b52347a666ffcf57651ba

    • SSDEEP

      6144:+60EDP6uCLfGw/GpxXinM1BCo1PlumGx2mx2tXd0t115JGJ:X5DpBw/KViMTB1MnEWk0115JO

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks