General

  • Target

    9b0a4b66456ab0811ca41dfd1a58484f

  • Size

    275KB

  • Sample

    240214-hl165sbh8x

  • MD5

    9b0a4b66456ab0811ca41dfd1a58484f

  • SHA1

    08a1a07dd30c5d6954dfa4e75ef133449f855cd0

  • SHA256

    335d5d8ec7dc191d2ac973e34c65d33381ff3a11da2bd99e7ae8f7f3636ada46

  • SHA512

    b9aae92d4338029d0586af0bfe09170779a5168549f6ce66e367423a08ca790641af904be426a2b4a77098a4e31c509fdd29cf25a2d4d15e917afe3f7a7fcd68

  • SSDEEP

    6144:NyPfYWVk+AQOwHUjj7bzrQ8Xu4MSLH3xvH/oC:NyPF+sOwaHbzrQmRLH3ZHg

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

200.75.39.254:80

201.185.69.28:443

206.189.232.2:8080

138.197.99.250:8080

167.71.148.58:443

190.45.24.210:80

110.39.162.2:443

201.75.62.86:80

46.105.114.137:8080

190.247.139.101:80

59.148.253.194:8080

137.74.106.111:7080

202.79.24.136:443

177.85.167.10:80

80.15.100.37:80

45.16.226.117:443

190.24.243.186:80

138.97.60.141:7080

2.80.112.146:80

81.214.253.80:443

rsa_pubkey.plain

Targets

    • Target

      9b0a4b66456ab0811ca41dfd1a58484f

    • Size

      275KB

    • MD5

      9b0a4b66456ab0811ca41dfd1a58484f

    • SHA1

      08a1a07dd30c5d6954dfa4e75ef133449f855cd0

    • SHA256

      335d5d8ec7dc191d2ac973e34c65d33381ff3a11da2bd99e7ae8f7f3636ada46

    • SHA512

      b9aae92d4338029d0586af0bfe09170779a5168549f6ce66e367423a08ca790641af904be426a2b4a77098a4e31c509fdd29cf25a2d4d15e917afe3f7a7fcd68

    • SSDEEP

      6144:NyPfYWVk+AQOwHUjj7bzrQ8Xu4MSLH3xvH/oC:NyPF+sOwaHbzrQmRLH3ZHg

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks