General

  • Target

    2024-02-15_3d2a7c58ecbedcece2d04cfcd0b77c26_icedid

  • Size

    288KB

  • Sample

    240215-x5w4vsee3z

  • MD5

    3d2a7c58ecbedcece2d04cfcd0b77c26

  • SHA1

    08ee8c44d09b63bc53d809d2a6b90404ecadbad4

  • SHA256

    9321008ad371a07c6846529c26604e321d84bbcf8fddb0bfdc1c9d383c584364

  • SHA512

    e66952c0886ebb49d1d36945f6d9698eaf764cd9d16015f2d2323e031c5a79ce77d2dc98517e407fbe4bd6f135e7b5b2e49d40c902c366898a5c41e70c778b30

  • SSDEEP

    6144:5x9OQzHuhE+8sOf8xP53fFdpk8cB8ehccxzPmkAYUbHnpWyAL0:5xwSuhfG8xP1Nnkd8eaWUbJpAL

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

93.148.247.169:80

110.39.160.38:443

1.234.65.61:80

172.245.248.239:8080

202.79.24.136:443

110.39.162.2:443

80.249.176.206:80

104.131.41.185:8080

177.144.130.105:443

68.183.190.199:8080

181.58.181.9:80

59.148.253.194:8080

45.4.32.50:80

192.232.229.54:7080

209.236.123.42:8080

111.67.12.222:8080

81.213.175.132:80

46.101.58.37:8080

80.15.100.37:80

103.236.179.162:80

rsa_pubkey.plain

Targets

    • Target

      2024-02-15_3d2a7c58ecbedcece2d04cfcd0b77c26_icedid

    • Size

      288KB

    • MD5

      3d2a7c58ecbedcece2d04cfcd0b77c26

    • SHA1

      08ee8c44d09b63bc53d809d2a6b90404ecadbad4

    • SHA256

      9321008ad371a07c6846529c26604e321d84bbcf8fddb0bfdc1c9d383c584364

    • SHA512

      e66952c0886ebb49d1d36945f6d9698eaf764cd9d16015f2d2323e031c5a79ce77d2dc98517e407fbe4bd6f135e7b5b2e49d40c902c366898a5c41e70c778b30

    • SSDEEP

      6144:5x9OQzHuhE+8sOf8xP53fFdpk8cB8ehccxzPmkAYUbHnpWyAL0:5xwSuhfG8xP1Nnkd8eaWUbJpAL

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks