General

  • Target

    2024-02-05_048f19cbfe92d7c364da742c2ab700e4_icedid

  • Size

    385KB

  • Sample

    240205-tt7vfabhf8

  • MD5

    048f19cbfe92d7c364da742c2ab700e4

  • SHA1

    4cc43763f35011837ac1eaff965de4887a822bfd

  • SHA256

    798b13a65f61210e96d246d5e8f797eec0c0bc4b856856bc36f753c7ff8718e7

  • SHA512

    a592a30c7ac75778145fbb9dfe299c41c63f2dbfc6d6b80a3933da336913667ee0de375685818c9c55833beaa5328c9184df5378777b4013bfc5c54354e75e07

  • SSDEEP

    6144:it4XJh2c4kgKO0mUv8+LfXXMrUzM43IGQePKSQqEP90/0eeBpT:ibKO0TPDIUzM43IkKgEP90/7ev

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

49.205.182.134:80

72.229.97.235:80

188.165.214.98:8080

185.201.9.197:8080

64.207.182.168:8080

5.39.91.110:7080

155.186.9.160:80

24.178.90.49:80

157.245.99.39:8080

174.118.202.24:443

50.246.154.69:80

79.137.83.50:443

110.145.11.73:80

190.29.166.0:80

176.111.60.55:8080

24.69.65.8:8080

46.105.131.79:8080

62.30.7.67:443

172.125.40.123:80

209.141.54.221:7080

rsa_pubkey.plain

Targets

    • Target

      2024-02-05_048f19cbfe92d7c364da742c2ab700e4_icedid

    • Size

      385KB

    • MD5

      048f19cbfe92d7c364da742c2ab700e4

    • SHA1

      4cc43763f35011837ac1eaff965de4887a822bfd

    • SHA256

      798b13a65f61210e96d246d5e8f797eec0c0bc4b856856bc36f753c7ff8718e7

    • SHA512

      a592a30c7ac75778145fbb9dfe299c41c63f2dbfc6d6b80a3933da336913667ee0de375685818c9c55833beaa5328c9184df5378777b4013bfc5c54354e75e07

    • SSDEEP

      6144:it4XJh2c4kgKO0mUv8+LfXXMrUzM43IGQePKSQqEP90/0eeBpT:ibKO0TPDIUzM43IkKgEP90/7ev

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks