General

  • Target

    2f65aaa1cd38a4f10ab6bb47f25c8e622cd5e2c2f688e1c56425b999dcbbf9b7

  • Size

    807KB

  • Sample

    240226-1dz8zsha4t

  • MD5

    1ccf3a827f442a334ae169ab192b35aa

  • SHA1

    a8c82063cb9ce425f089f7dc3bd57dd7b8de104a

  • SHA256

    2f65aaa1cd38a4f10ab6bb47f25c8e622cd5e2c2f688e1c56425b999dcbbf9b7

  • SHA512

    49dae9d048fa785ee9b7a9e72ac3e4f329416224b7770889d22d165450cd26ac1b3c4723c33ef56950f735583dcfb1bcd54cf6c2d11031bfd39f4ad5fce166d9

  • SSDEEP

    12288:e0cIaDb/1wUCBVpjl18kVtLga3xjZHySM+tbpZx9PIQOlp2m:ewwZBSG+3/HySVbJ9LOIm

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

217.182.143.248:8080

185.4.135.27:8080

192.99.251.50:443

146.59.226.45:443

162.214.118.104:8080

195.154.133.20:443

103.75.201.2:443

5.9.116.246:8080

177.87.70.10:8080

31.24.158.56:8080

103.75.201.4:443

158.69.222.101:443

185.157.82.211:8080

185.8.212.130:7080

186.250.48.117:7080

110.232.117.186:8080

46.55.222.11:443

196.218.30.83:443

51.91.7.5:8080

176.56.128.118:443

eck1.plain
ecs1.plain

Targets

    • Target

      2f65aaa1cd38a4f10ab6bb47f25c8e622cd5e2c2f688e1c56425b999dcbbf9b7

    • Size

      807KB

    • MD5

      1ccf3a827f442a334ae169ab192b35aa

    • SHA1

      a8c82063cb9ce425f089f7dc3bd57dd7b8de104a

    • SHA256

      2f65aaa1cd38a4f10ab6bb47f25c8e622cd5e2c2f688e1c56425b999dcbbf9b7

    • SHA512

      49dae9d048fa785ee9b7a9e72ac3e4f329416224b7770889d22d165450cd26ac1b3c4723c33ef56950f735583dcfb1bcd54cf6c2d11031bfd39f4ad5fce166d9

    • SSDEEP

      12288:e0cIaDb/1wUCBVpjl18kVtLga3xjZHySM+tbpZx9PIQOlp2m:ewwZBSG+3/HySVbJ9LOIm

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks