General

  • Target

    2024-02-17_d06660dfd052afa6e47b93a92bfc15a3_icedid

  • Size

    332KB

  • Sample

    240217-fs21xaca56

  • MD5

    d06660dfd052afa6e47b93a92bfc15a3

  • SHA1

    0a3ac821083dfd392e14acb5f6ff031743644e8f

  • SHA256

    266922c17554a64e07de0d8786631aec7d902ec8573732bc4f62353857f5c0ed

  • SHA512

    732e6c3a95e445d1b837601ef17b1d94a6690dd915940f9e2019d199f0e79445d89ff1106ded5ad6cf2dc860b9004544e8549968637b64ae4cfb7695bc4e231f

  • SSDEEP

    6144:VT2ZfcAZDQvEL9QdUW1UWKUWl197qo1Do:Z2ZC8SdUAUHUO19Ool

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

98.192.74.164:80

59.135.126.129:443

24.70.40.15:8080

178.33.167.120:8080

144.76.56.36:8080

176.58.93.123:80

51.38.134.203:8080

58.92.179.55:443

190.201.144.85:7080

201.183.251.100:80

192.210.217.94:8080

14.161.30.33:443

212.112.113.235:80

23.253.207.142:8080

1.217.126.11:443

61.221.152.140:80

78.189.165.52:8080

149.202.153.251:8080

91.73.169.210:80

212.129.14.27:8080

rsa_pubkey.plain

Targets

    • Target

      2024-02-17_d06660dfd052afa6e47b93a92bfc15a3_icedid

    • Size

      332KB

    • MD5

      d06660dfd052afa6e47b93a92bfc15a3

    • SHA1

      0a3ac821083dfd392e14acb5f6ff031743644e8f

    • SHA256

      266922c17554a64e07de0d8786631aec7d902ec8573732bc4f62353857f5c0ed

    • SHA512

      732e6c3a95e445d1b837601ef17b1d94a6690dd915940f9e2019d199f0e79445d89ff1106ded5ad6cf2dc860b9004544e8549968637b64ae4cfb7695bc4e231f

    • SSDEEP

      6144:VT2ZfcAZDQvEL9QdUW1UWKUWl197qo1Do:Z2ZC8SdUAUHUO19Ool

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks