General

  • Target

    4609c19a333114a5786ed22f4ba0694f0cd89d954661f945fdc4b71c9fe0bb47_NeikiAnalytics

  • Size

    156KB

  • Sample

    240521-n7pywsda2z

  • MD5

    5dd02e7beb92910cc1f3c3a8159a4b2f

  • SHA1

    d589ca6da5c25ecfea0f7f2ece6fd20ae02a130c

  • SHA256

    4609c19a333114a5786ed22f4ba0694f0cd89d954661f945fdc4b71c9fe0bb47

  • SHA512

    cc72aa3dcb3553acc0f49f485241252bbb59e7d55d829f52479fec786057b6570d3d9d673ea11e6b2bce0c8f9826d561cf8da060c2f342a8b6ffea6b01aa1f5c

  • SSDEEP

    3072:fE8Hiuuq5zv1PlPQ9vj/t+VeFZ7JamJp2Lom9OTHk1:fXuqlPQ9vjF+wZsgmj

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

50.121.220.50:80

51.75.33.122:80

54.37.42.48:8080

91.121.54.71:8080

83.169.21.32:7080

68.69.155.181:80

67.247.242.247:80

213.197.182.158:8080

45.173.88.33:80

111.67.12.221:8080

217.13.106.14:8080

191.99.160.58:80

178.148.55.236:8080

85.109.159.61:443

110.142.219.51:80

50.28.51.143:8080

77.90.136.129:8080

209.236.123.42:8080

72.135.200.124:80

184.66.18.83:80

rsa_pubkey.plain

Targets

    • Target

      4609c19a333114a5786ed22f4ba0694f0cd89d954661f945fdc4b71c9fe0bb47_NeikiAnalytics

    • Size

      156KB

    • MD5

      5dd02e7beb92910cc1f3c3a8159a4b2f

    • SHA1

      d589ca6da5c25ecfea0f7f2ece6fd20ae02a130c

    • SHA256

      4609c19a333114a5786ed22f4ba0694f0cd89d954661f945fdc4b71c9fe0bb47

    • SHA512

      cc72aa3dcb3553acc0f49f485241252bbb59e7d55d829f52479fec786057b6570d3d9d673ea11e6b2bce0c8f9826d561cf8da060c2f342a8b6ffea6b01aa1f5c

    • SSDEEP

      3072:fE8Hiuuq5zv1PlPQ9vj/t+VeFZ7JamJp2Lom9OTHk1:fXuqlPQ9vjF+wZsgmj

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Matrix

Tasks