General

  • Target

    62115fe38e45953db9ad34ba3eee93d34e3910dd11b0bc45e116242c46dc2fb8

  • Size

    229KB

  • Sample

    240409-zjry5aec3z

  • MD5

    9a95a93aa3714b8a0e84957f5b768641

  • SHA1

    bba091aadaf35c8df40264afe6fa7bcc2062aa5d

  • SHA256

    62115fe38e45953db9ad34ba3eee93d34e3910dd11b0bc45e116242c46dc2fb8

  • SHA512

    c7184d643a7443392791512985e213dbf8c9ec39ff5c903d45ae2604ca982adaf0d2f6bb2f35fc4136e26282816cc3b3a7de7a7abc2e93fc2ba8fb13931a008c

  • SSDEEP

    6144:ehrCXbsViWTyWJ+7voqH3eMlnh7eG/nMMYdAFSpPP:ewIVikPJqQa3eMPF/MnESpP

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

24.231.88.85:80

191.112.178.60:80

50.116.111.59:8080

173.249.20.233:443

188.165.214.98:8080

74.40.205.197:443

62.75.141.82:80

2.58.16.89:8080

188.219.31.12:80

95.213.236.64:8080

72.186.136.247:443

185.201.9.197:8080

203.153.216.189:7080

202.134.4.216:8080

72.229.97.235:80

24.179.13.119:80

174.118.202.24:443

74.208.45.104:8080

51.89.36.180:443

202.141.243.254:443

rsa_pubkey.plain

Targets

    • Target

      62115fe38e45953db9ad34ba3eee93d34e3910dd11b0bc45e116242c46dc2fb8

    • Size

      229KB

    • MD5

      9a95a93aa3714b8a0e84957f5b768641

    • SHA1

      bba091aadaf35c8df40264afe6fa7bcc2062aa5d

    • SHA256

      62115fe38e45953db9ad34ba3eee93d34e3910dd11b0bc45e116242c46dc2fb8

    • SHA512

      c7184d643a7443392791512985e213dbf8c9ec39ff5c903d45ae2604ca982adaf0d2f6bb2f35fc4136e26282816cc3b3a7de7a7abc2e93fc2ba8fb13931a008c

    • SSDEEP

      6144:ehrCXbsViWTyWJ+7voqH3eMlnh7eG/nMMYdAFSpPP:ewIVikPJqQa3eMPF/MnESpP

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • UPX dump on OEP (original entry point)

    • Blocklisted process makes network request

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Matrix

Tasks