General

  • Target

    V9ofyxp.exe

  • Size

    728KB

  • Sample

    240203-vaycbsgbcq

  • MD5

    32ddc8c6cce0c422f28b5063b01e7c28

  • SHA1

    878553b111313c8524e4dac79d5c9fcbf0b9318f

  • SHA256

    522c24265f455ad563b1f6f6b8e431c6b6b6885d86fbb0e2a0a9b7c176838012

  • SHA512

    a5e92e59d47ef1a3f90e76562f9e3c1fc7fbb4473a39704ec3dd59633c981703270b70ce86897c89b3615add465c16c05590daa5f31dc8b23afc57d536977901

  • SSDEEP

    12288:phUTxVtDPZgnvswTCVVulW5iflwBqH5UlivS+WVQ:ItDPZSXCrxMwkHilBz

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

188.157.101.114:80

192.175.111.214:8080

95.85.33.23:8080

192.232.229.54:7080

181.30.61.163:443

186.70.127.199:8090

200.127.14.97:80

70.169.17.134:80

24.232.228.233:80

172.104.169.32:8080

50.28.51.143:8080

177.73.0.98:443

149.202.72.142:7080

37.187.161.206:8080

202.29.239.162:443

213.197.182.158:8080

202.134.4.210:7080

190.24.243.186:80

201.213.177.139:80

105.209.235.113:8080

rsa_pubkey.plain

Targets

    • Target

      V9ofyxp.exe

    • Size

      728KB

    • MD5

      32ddc8c6cce0c422f28b5063b01e7c28

    • SHA1

      878553b111313c8524e4dac79d5c9fcbf0b9318f

    • SHA256

      522c24265f455ad563b1f6f6b8e431c6b6b6885d86fbb0e2a0a9b7c176838012

    • SHA512

      a5e92e59d47ef1a3f90e76562f9e3c1fc7fbb4473a39704ec3dd59633c981703270b70ce86897c89b3615add465c16c05590daa5f31dc8b23afc57d536977901

    • SSDEEP

      12288:phUTxVtDPZgnvswTCVVulW5iflwBqH5UlivS+WVQ:ItDPZSXCrxMwkHilBz

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

    • Dave packer

      Detects executable using a packer named 'Dave' by the community, based on a string at the end.

MITRE ATT&CK Matrix

Tasks