General

  • Target

    2024-02-05_f86297e4942ac389f8e1659511f6c88d_icedid

  • Size

    340KB

  • Sample

    240205-tyjcmseabj

  • MD5

    f86297e4942ac389f8e1659511f6c88d

  • SHA1

    24c6e26e841f6d20565a059e6b10d1c216b6c87d

  • SHA256

    83b6a7fed84ef1bf8868e8c73a86ef3d224b695e16d5c50647a53a88cefc7e91

  • SHA512

    b672f254ed1339e472c8c965c6156bca15bab67a8d71c13fbbae964d01fbb2385e4974899197eaaa862fed65fa446cba4e13c0df8d1130308a4c30638a1f36e5

  • SSDEEP

    6144:fcfe70CBlX7tmbBMY62Kb9ykhRYAr76Ky7MFjWPVxZK:0fSX7qBMY62Kb9JYArLqXI

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

50.246.154.69:80

58.1.242.115:80

200.111.198.76:80

185.201.9.197:8080

64.207.182.168:8080

168.235.67.138:7080

202.134.4.216:8080

155.186.9.160:80

201.241.127.190:80

139.99.158.11:443

5.2.212.254:80

72.186.136.247:443

120.150.218.241:443

119.59.116.21:8080

62.171.142.179:8080

2.58.16.89:8080

62.30.7.67:443

190.146.92.48:80

136.244.110.184:8080

138.68.87.218:443

rsa_pubkey.plain

Targets

    • Target

      2024-02-05_f86297e4942ac389f8e1659511f6c88d_icedid

    • Size

      340KB

    • MD5

      f86297e4942ac389f8e1659511f6c88d

    • SHA1

      24c6e26e841f6d20565a059e6b10d1c216b6c87d

    • SHA256

      83b6a7fed84ef1bf8868e8c73a86ef3d224b695e16d5c50647a53a88cefc7e91

    • SHA512

      b672f254ed1339e472c8c965c6156bca15bab67a8d71c13fbbae964d01fbb2385e4974899197eaaa862fed65fa446cba4e13c0df8d1130308a4c30638a1f36e5

    • SSDEEP

      6144:fcfe70CBlX7tmbBMY62Kb9ykhRYAr76Ky7MFjWPVxZK:0fSX7qBMY62Kb9JYArLqXI

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks