General

  • Target

    a6276be3b2976a066cad14cacfd1264e75e7b1f99e0a588f4415efb55b80d6b0

  • Size

    736KB

  • Sample

    240226-1x6vwahc68

  • MD5

    8de6f0db50a0731d34a8943dd739e0dc

  • SHA1

    ceae5dc08531548f74fa3a46b9a66a4ddb3422bd

  • SHA256

    a6276be3b2976a066cad14cacfd1264e75e7b1f99e0a588f4415efb55b80d6b0

  • SHA512

    0b9cb8c5579e3d0e0ba2a804fda952308e23623ee5c04eee78e2a5790d4c4b213c0020df1bb9ae1f846b39b159026193d336ad4707ff5b4c44c7b8f2e4ebcafc

  • SSDEEP

    12288:WZjb8BOPxue5dKV9M/98f0koP5XvkgKtuBdfMAofD:WCBAdKV9Xf0kK3KMBdkAofD

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

45.76.1.145:443

217.182.25.250:8080

119.193.124.41:7080

192.99.251.50:443

146.59.226.45:443

173.212.193.249:8080

207.38.84.195:8080

45.118.135.203:7080

31.24.158.56:8080

209.126.98.206:8080

212.237.17.99:8080

216.158.226.206:443

50.30.40.196:8080

82.165.152.127:8080

159.8.59.82:8080

107.182.225.142:8080

110.232.117.186:8080

72.15.201.15:8080

5.9.116.246:8080

79.172.212.216:8080

eck1.plain
ecs1.plain

Targets

    • Target

      a6276be3b2976a066cad14cacfd1264e75e7b1f99e0a588f4415efb55b80d6b0

    • Size

      736KB

    • MD5

      8de6f0db50a0731d34a8943dd739e0dc

    • SHA1

      ceae5dc08531548f74fa3a46b9a66a4ddb3422bd

    • SHA256

      a6276be3b2976a066cad14cacfd1264e75e7b1f99e0a588f4415efb55b80d6b0

    • SHA512

      0b9cb8c5579e3d0e0ba2a804fda952308e23623ee5c04eee78e2a5790d4c4b213c0020df1bb9ae1f846b39b159026193d336ad4707ff5b4c44c7b8f2e4ebcafc

    • SSDEEP

      12288:WZjb8BOPxue5dKV9M/98f0koP5XvkgKtuBdfMAofD:WCBAdKV9Xf0kK3KMBdkAofD

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks