General

  • Target

    J_3Q.bin.zip

  • Size

    134KB

  • Sample

    240523-pl66qahd3y

  • MD5

    854adc6396fea68470de0200b5f44b5e

  • SHA1

    69d69f469d9d334a5ebd15112ed684dfd7129a5f

  • SHA256

    e7f04e95c867caf928b3beaf2bc55dccd9d90704be6fda4620ab0b18613b00d1

  • SHA512

    02094329b8fbc98cb2a88d4736ab1c3c3b4be378ab37a3386b4a48c42c413c9e2930875344fb1f07f2d68ad4d65cf6ef3740e2b79024f74df0f75c991376c252

  • SSDEEP

    3072:xyHwiCdvE52LspqiRW5uR1J1hANlAYhGhaxXPC8tIfDXlTiyDCQ:xyHz2Laqis5uR/Quk/C8ObVmyF

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

181.10.46.92:80

2.58.16.88:8080

206.189.232.2:8080

178.250.54.208:8080

167.71.148.58:443

202.134.4.210:7080

187.162.248.237:80

78.206.229.130:80

85.214.26.7:8080

5.196.35.138:7080

1.226.84.243:8080

110.39.162.2:443

185.183.16.47:80

152.231.89.226:80

138.97.60.141:7080

94.176.234.118:443

46.101.58.37:8080

93.146.143.191:80

70.32.84.74:8080

137.74.106.111:7080

rsa_pubkey.plain

Targets

    • Target

      J_3Q.bin

    • Size

      348KB

    • MD5

      ba32e0e7d1851f0b9450745036e081c7

    • SHA1

      cddb67e77ab6c900c9c547a66f5998ae839ab75f

    • SHA256

      92538ce0e54b480320d1d5d85a5b464f4c95fddc042e887b293082e3641c9b80

    • SHA512

      6fe2107b8e30bcde8585812ff0445258b939397c20d86e6d6abe06e55cf49c475e1ea995988bd8e1a785506755bfab0aec39c1e00478cd741441c7ffd154fe60

    • SSDEEP

      3072:Sa99Ky1S0SD8MHjO73Ba01/H/7FlwZ2RJJBvX+WUE742Lg:SaGy1nS8MHi7xai73JtkWUEn0

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks