General

  • Target

    a92274af21bd9171cbfa81976477b6571e721ff5d674b44a18f9dea69f844f30

  • Size

    732KB

  • Sample

    240226-15aseaab31

  • MD5

    871e9e76f1a1023f6b399513a7d625b0

  • SHA1

    25eb0cc412d8b8165322a7204038173e5d1f5397

  • SHA256

    a92274af21bd9171cbfa81976477b6571e721ff5d674b44a18f9dea69f844f30

  • SHA512

    076316bbf6ac15c77e58c3a0de3343d09ed32aec27562a6fbb2359f88f018dee1c9eb96065efaa860683270e3c2ac38bdfbb8ee8e1bc3099d72a4998d0bbd28c

  • SSDEEP

    12288:S54yM33d3q3Z7BogIreNmF+U/9JckIAGfUebvoWRWwfpW:SKh3831Bo2N6+ADckbebX7pW

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

80.211.107.116:8080

188.166.229.148:443

121.78.112.42:8080

185.148.168.15:8080

210.57.209.142:8080

194.9.172.107:8080

139.196.72.155:8080

128.199.192.135:8080

62.171.178.147:8080

103.133.214.242:8080

104.131.62.48:8080

103.41.204.169:8080

54.37.106.167:8080

217.182.143.207:443

185.148.168.220:8080

202.134.4.210:7080

198.199.98.78:8080

5.56.132.177:8080

66.42.57.149:443

78.46.73.125:443

eck1.plain
ecs1.plain

Targets

    • Target

      a92274af21bd9171cbfa81976477b6571e721ff5d674b44a18f9dea69f844f30

    • Size

      732KB

    • MD5

      871e9e76f1a1023f6b399513a7d625b0

    • SHA1

      25eb0cc412d8b8165322a7204038173e5d1f5397

    • SHA256

      a92274af21bd9171cbfa81976477b6571e721ff5d674b44a18f9dea69f844f30

    • SHA512

      076316bbf6ac15c77e58c3a0de3343d09ed32aec27562a6fbb2359f88f018dee1c9eb96065efaa860683270e3c2ac38bdfbb8ee8e1bc3099d72a4998d0bbd28c

    • SSDEEP

      12288:S54yM33d3q3Z7BogIreNmF+U/9JckIAGfUebvoWRWwfpW:SKh3831Bo2N6+ADckbebX7pW

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks