General

  • Target

    9202c7539511c9cd8fbbe8f2aedb7e77

  • Size

    342KB

  • Sample

    240205-ps1yaafgg6

  • MD5

    9202c7539511c9cd8fbbe8f2aedb7e77

  • SHA1

    8544757efbf0d069575d7581557512297244ac15

  • SHA256

    89d7690047473c67f0ab3fce300787c6121f1d6523036d741c5fbb5ee45d5102

  • SHA512

    058a5b9c104266857ee6b9b01c1b87cbe9b4a56ba8037d7b75b01d18701c4d38f1532d453072fb8bfa49807fc84bec0826b1ac87d44e16a48512018740643783

  • SSDEEP

    3072:e/GZgCBD0JqvjYGRKbGUUtvAMdg6Ygpr7kL2LWsFzMFruzRy6KH:iGSkDgqvPRKib6+g8rtLWFc4tH

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

12.175.220.98:80

162.241.204.233:8080

50.116.111.59:8080

172.86.188.251:8080

139.99.158.11:443

66.57.108.14:443

75.177.207.146:80

194.190.67.75:80

50.245.107.73:443

173.70.61.180:80

85.105.205.77:8080

104.131.11.150:443

62.75.141.82:80

70.92.118.112:80

194.4.58.192:7080

120.150.60.189:80

24.231.88.85:80

78.24.219.147:8080

110.142.236.207:80

119.59.116.21:8080

rsa_pubkey.plain

Targets

    • Target

      9202c7539511c9cd8fbbe8f2aedb7e77

    • Size

      342KB

    • MD5

      9202c7539511c9cd8fbbe8f2aedb7e77

    • SHA1

      8544757efbf0d069575d7581557512297244ac15

    • SHA256

      89d7690047473c67f0ab3fce300787c6121f1d6523036d741c5fbb5ee45d5102

    • SHA512

      058a5b9c104266857ee6b9b01c1b87cbe9b4a56ba8037d7b75b01d18701c4d38f1532d453072fb8bfa49807fc84bec0826b1ac87d44e16a48512018740643783

    • SSDEEP

      3072:e/GZgCBD0JqvjYGRKbGUUtvAMdg6Ygpr7kL2LWsFzMFruzRy6KH:iGSkDgqvPRKib6+g8rtLWFc4tH

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks