General

  • Target

    ca13e5376702f5b2d761ffb816b1cd27

  • Size

    556KB

  • Sample

    240315-baz2dace7t

  • MD5

    ca13e5376702f5b2d761ffb816b1cd27

  • SHA1

    4f11b9b8e8ffb34908aa3ab18af13a43e1b1dc86

  • SHA256

    e787dba061d08479637fc625bb901d4c8730bf5af3d079776f0c12a37ca8562f

  • SHA512

    4f1828dda7336e40bd2f539f30ebe22a2bb0da409798f0d440137f919da38a0454ee785a62abaed21c37a969ff4bd6214f22cb195bd7fb079f6b41584a184634

  • SSDEEP

    12288:ubFmNHloUQYbEZpakjYDJA1zpYDwUeiRjPjMZ:rHNQYbuDj6SfKjPG

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

109.166.89.91:80

200.71.193.220:443

118.200.218.193:443

104.236.137.72:8080

172.104.233.225:8080

213.189.36.51:8080

85.234.143.94:8080

68.183.190.199:8080

5.196.35.138:7080

96.20.84.254:7080

69.163.33.84:8080

207.154.204.40:8080

2.38.99.79:80

50.28.51.143:8080

189.173.113.67:443

181.135.153.203:443

134.209.214.126:8080

62.75.143.100:7080

182.48.194.6:8090

86.42.166.147:80

rsa_pubkey.plain

Targets

    • Target

      ca13e5376702f5b2d761ffb816b1cd27

    • Size

      556KB

    • MD5

      ca13e5376702f5b2d761ffb816b1cd27

    • SHA1

      4f11b9b8e8ffb34908aa3ab18af13a43e1b1dc86

    • SHA256

      e787dba061d08479637fc625bb901d4c8730bf5af3d079776f0c12a37ca8562f

    • SHA512

      4f1828dda7336e40bd2f539f30ebe22a2bb0da409798f0d440137f919da38a0454ee785a62abaed21c37a969ff4bd6214f22cb195bd7fb079f6b41584a184634

    • SSDEEP

      12288:ubFmNHloUQYbEZpakjYDJA1zpYDwUeiRjPjMZ:rHNQYbuDj6SfKjPG

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks