General

  • Target

    2024-02-05_d506afa0ec84db29b42175f6baf63cb6_icedid

  • Size

    283KB

  • Sample

    240205-txxtmscae3

  • MD5

    d506afa0ec84db29b42175f6baf63cb6

  • SHA1

    2b43169325c5907c83f4bb5f2f50efe6ecdabc5d

  • SHA256

    b1d62fa44ef019260bb465b5a40a82b372d0c4c5695e5f0c1b239c1318bad7ff

  • SHA512

    b16732065adfc8d985629ab212170a12bc9aaa3234d755bf71bf765cc72844dc71f95ceb8faedae3ffbb0a8f5570a3a2a0240c2c5b72878f9b3d9cc9b49b4079

  • SSDEEP

    6144:nJzrn0Fmcf1E+pBvYXuze9+77swVVBKnuQGi4MQ:nNI1E+pBXe9+JrcZ4D

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

49.205.182.134:80

72.229.97.235:80

188.165.214.98:8080

185.201.9.197:8080

64.207.182.168:8080

5.39.91.110:7080

155.186.9.160:80

24.178.90.49:80

157.245.99.39:8080

174.118.202.24:443

50.246.154.69:80

79.137.83.50:443

110.145.11.73:80

190.29.166.0:80

176.111.60.55:8080

24.69.65.8:8080

46.105.131.79:8080

62.30.7.67:443

172.125.40.123:80

209.141.54.221:7080

rsa_pubkey.plain

Targets

    • Target

      2024-02-05_d506afa0ec84db29b42175f6baf63cb6_icedid

    • Size

      283KB

    • MD5

      d506afa0ec84db29b42175f6baf63cb6

    • SHA1

      2b43169325c5907c83f4bb5f2f50efe6ecdabc5d

    • SHA256

      b1d62fa44ef019260bb465b5a40a82b372d0c4c5695e5f0c1b239c1318bad7ff

    • SHA512

      b16732065adfc8d985629ab212170a12bc9aaa3234d755bf71bf765cc72844dc71f95ceb8faedae3ffbb0a8f5570a3a2a0240c2c5b72878f9b3d9cc9b49b4079

    • SSDEEP

      6144:nJzrn0Fmcf1E+pBvYXuze9+77swVVBKnuQGi4MQ:nNI1E+pBXe9+JrcZ4D

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks