General

  • Target

    2024-02-04_03524f8d7f9ae93720f34293ecfe3130_icedid

  • Size

    388KB

  • Sample

    240204-mecmesfaf5

  • MD5

    03524f8d7f9ae93720f34293ecfe3130

  • SHA1

    3b4f7bdceb3efce697b48aabae0a1c8b3d045415

  • SHA256

    b6bf4fffe1fc94a1f44fd05a8782291d113486db5fcfa9cf04b80a7f816d727e

  • SHA512

    e85dd5420b9616330fbb50f3e6d7f7f2690907c3bcd166829a9d5be5141dbddeb3b5d0e0bc3249d12ab33ae23776c89d75bf51796d5daec6d885dfa8aa1fc9e2

  • SSDEEP

    6144:7KIHCIcX4WScpdOQRFSFRxc0gmKMBISphOxkTtsHNnL4BjxAtI0pjfK89l:7xCTX4WrhFSF3c8KwJEL4BjCI0xz/

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

104.236.137.72:8080

172.104.233.225:8080

213.189.36.51:8080

85.234.143.94:8080

119.59.124.163:8080

190.146.131.105:8080

186.23.132.93:990

200.113.106.18:80

163.172.40.218:7080

187.190.49.92:443

201.190.133.235:8080

46.28.111.142:7080

104.131.58.132:8080

14.160.93.230:80

201.163.74.202:443

200.124.225.32:80

203.130.0.69:80

181.36.42.205:443

182.48.194.6:8090

87.106.77.40:7080

rsa_pubkey.plain

Targets

    • Target

      2024-02-04_03524f8d7f9ae93720f34293ecfe3130_icedid

    • Size

      388KB

    • MD5

      03524f8d7f9ae93720f34293ecfe3130

    • SHA1

      3b4f7bdceb3efce697b48aabae0a1c8b3d045415

    • SHA256

      b6bf4fffe1fc94a1f44fd05a8782291d113486db5fcfa9cf04b80a7f816d727e

    • SHA512

      e85dd5420b9616330fbb50f3e6d7f7f2690907c3bcd166829a9d5be5141dbddeb3b5d0e0bc3249d12ab33ae23776c89d75bf51796d5daec6d885dfa8aa1fc9e2

    • SSDEEP

      6144:7KIHCIcX4WScpdOQRFSFRxc0gmKMBISphOxkTtsHNnL4BjxAtI0pjfK89l:7xCTX4WrhFSF3c8KwJEL4BjCI0xz/

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks