General

  • Target

    2024-02-05_49f17f82a27017a6d29448e3b4d3e60e_icedid

  • Size

    292KB

  • Sample

    240205-twhckadhfn

  • MD5

    49f17f82a27017a6d29448e3b4d3e60e

  • SHA1

    848ff654b878641cbdef06d405cfe6b53da15533

  • SHA256

    69cfd02f34c75b34a03c4234c692626055285e71a8cab6878d98c83e92adb81d

  • SHA512

    0e490303e424522579a22a8cec838b30627c665d1ab2c47eb7bbec030c07383d34dde36f2f85db88c44fc9a05a30bcfd7dc271191cfd7332737c57882f226f15

  • SSDEEP

    6144:/xvUzHAmeoLfv9dUCOZqUMEtKWV1ioI3xIiPO4UBrfDdt:/xvRmeitOCOU6tPriocdIrfD

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

47.144.21.37:80

181.171.209.241:443

200.111.198.76:80

185.201.9.197:8080

64.207.182.168:8080

155.186.9.160:80

74.128.121.17:80

78.24.219.147:8080

110.142.236.207:80

72.186.136.247:443

87.106.139.101:8080

119.59.116.21:8080

167.114.153.111:8080

202.134.4.211:8080

58.1.242.115:80

161.0.153.60:80

50.91.114.38:80

62.30.7.67:443

208.74.26.234:80

172.104.97.173:8080

rsa_pubkey.plain

Targets

    • Target

      2024-02-05_49f17f82a27017a6d29448e3b4d3e60e_icedid

    • Size

      292KB

    • MD5

      49f17f82a27017a6d29448e3b4d3e60e

    • SHA1

      848ff654b878641cbdef06d405cfe6b53da15533

    • SHA256

      69cfd02f34c75b34a03c4234c692626055285e71a8cab6878d98c83e92adb81d

    • SHA512

      0e490303e424522579a22a8cec838b30627c665d1ab2c47eb7bbec030c07383d34dde36f2f85db88c44fc9a05a30bcfd7dc271191cfd7332737c57882f226f15

    • SSDEEP

      6144:/xvUzHAmeoLfv9dUCOZqUMEtKWV1ioI3xIiPO4UBrfDdt:/xvRmeitOCOU6tPriocdIrfD

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks