General

  • Target

    2024-02-05_ae1cf033153c6e0669540e66ba4c417c_icedid

  • Size

    417KB

  • Sample

    240205-zcckvshgej

  • MD5

    ae1cf033153c6e0669540e66ba4c417c

  • SHA1

    0199aa1aed423bf52ec9f7016500381a41e7c017

  • SHA256

    ef521f523e885223cbc6154fbec10bc736b3479fed1b6daa5a3d0e10b3ed4bca

  • SHA512

    6f68f26d9e124977ec0390e75de0376fba9fb4a58369d408054d88f85532ee9e494c16eea1b3893d844f921316590693256226049265738ea0bff0642109883b

  • SSDEEP

    6144:DsPM4Y3TqpL7YgYl44a7OwUwi5x+LiBfa0pU7UXVkLT80VRi1c0y30R6f81U:DsPM4Y3TqBOwUwiHnpU7UXC8UOx9oJ

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

181.30.69.50:80

157.7.199.53:8080

190.163.1.31:8080

68.183.170.114:8080

192.241.143.52:8080

192.241.146.84:8080

46.214.11.172:80

61.92.159.208:8080

104.131.41.185:8080

137.74.106.111:7080

5.196.35.138:7080

89.32.150.160:8080

177.144.135.2:80

190.194.242.254:443

217.199.160.224:7080

83.169.21.32:7080

190.17.195.202:80

111.67.12.221:8080

177.66.190.130:80

186.70.127.199:8090

rsa_pubkey.plain

Targets

    • Target

      2024-02-05_ae1cf033153c6e0669540e66ba4c417c_icedid

    • Size

      417KB

    • MD5

      ae1cf033153c6e0669540e66ba4c417c

    • SHA1

      0199aa1aed423bf52ec9f7016500381a41e7c017

    • SHA256

      ef521f523e885223cbc6154fbec10bc736b3479fed1b6daa5a3d0e10b3ed4bca

    • SHA512

      6f68f26d9e124977ec0390e75de0376fba9fb4a58369d408054d88f85532ee9e494c16eea1b3893d844f921316590693256226049265738ea0bff0642109883b

    • SSDEEP

      6144:DsPM4Y3TqpL7YgYl44a7OwUwi5x+LiBfa0pU7UXVkLT80VRi1c0y30R6f81U:DsPM4Y3TqBOwUwiHnpU7UXC8UOx9oJ

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks