General

  • Target

    2024-04-06_dd42c2dda17be426a5069af6daee18ce_icedid

  • Size

    366KB

  • Sample

    240406-lw55magc83

  • MD5

    dd42c2dda17be426a5069af6daee18ce

  • SHA1

    accf24ab7d242fadf77a7f87ffea4eb4d6a3709f

  • SHA256

    978e925254a2ea08bd3cf5aa0a11fa27a4c68ef43eac48a0b5e4e160bc6252ae

  • SHA512

    1994534ed8d6d46b3bbdb548612ee459b87dd59e09e33c8020b6dd8e09322b74f32bcb8b2429882d6def9ac84689734d3209ba191436a9293d65e9822a1a1e0b

  • SSDEEP

    6144:UQkmnkjT/I+MeJCXmI+M8oIjlRaX+TJ2qcB4QrD/02TjL+e9c:UQl2Me0+M8oII+9uLt9c

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

152.170.108.99:443

99.252.27.6:80

93.148.252.90:80

96.126.121.64:443

104.236.137.72:8080

85.234.143.94:8080

80.85.87.122:8080

2.139.158.136:443

80.11.158.65:8080

79.31.85.103:80

77.55.211.77:8080

96.61.113.203:80

181.198.203.45:443

142.93.114.137:8080

186.15.83.52:8080

181.36.42.205:443

68.183.190.199:8080

159.203.204.126:8080

50.28.51.143:8080

46.101.212.195:8080

rsa_pubkey.plain

Targets

    • Target

      2024-04-06_dd42c2dda17be426a5069af6daee18ce_icedid

    • Size

      366KB

    • MD5

      dd42c2dda17be426a5069af6daee18ce

    • SHA1

      accf24ab7d242fadf77a7f87ffea4eb4d6a3709f

    • SHA256

      978e925254a2ea08bd3cf5aa0a11fa27a4c68ef43eac48a0b5e4e160bc6252ae

    • SHA512

      1994534ed8d6d46b3bbdb548612ee459b87dd59e09e33c8020b6dd8e09322b74f32bcb8b2429882d6def9ac84689734d3209ba191436a9293d65e9822a1a1e0b

    • SSDEEP

      6144:UQkmnkjT/I+MeJCXmI+M8oIjlRaX+TJ2qcB4QrD/02TjL+e9c:UQl2Me0+M8oII+9uLt9c

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks