General

  • Target

    ac9d7db6626843e5577ed3cfd627e96091b70a3fff21369e4b26f51554eeaf78.exe

  • Size

    376KB

  • Sample

    240524-knjqzsbe7z

  • MD5

    6d721d17474801a8d75be8a99ecf7efb

  • SHA1

    c8c01bff03f15172df7bc667118f5325fc831e38

  • SHA256

    ac9d7db6626843e5577ed3cfd627e96091b70a3fff21369e4b26f51554eeaf78

  • SHA512

    724ed02e5985d80fee87e19fe7fb73f51e74e58df02900c59c916b94e1a5b9c8082c6700c2fc71fdf620c6cbfcae0776bd1bd9bf253c9c1de7d0e2cc39f4d923

  • SSDEEP

    6144:aWKg4vCS9iocEDzogURsxLPH1wvR19SrIya/35VJRjjhow8Iyc:Noc0zogUiZw518rg/vaw7

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

69.14.208.221:80

156.155.163.232:80

211.42.204.154:80

164.68.115.146:8080

5.189.148.98:8080

46.105.128.215:8080

69.30.205.162:7080

182.176.116.139:995

72.51.153.27:80

124.150.175.129:8080

96.234.38.186:8080

139.59.12.63:8080

220.78.29.88:80

190.38.252.45:443

128.92.54.20:80

94.203.236.122:80

46.105.131.68:8080

162.144.46.90:8080

59.158.164.66:443

95.255.140.89:443

rsa_pubkey.plain

Targets

    • Target

      ac9d7db6626843e5577ed3cfd627e96091b70a3fff21369e4b26f51554eeaf78.exe

    • Size

      376KB

    • MD5

      6d721d17474801a8d75be8a99ecf7efb

    • SHA1

      c8c01bff03f15172df7bc667118f5325fc831e38

    • SHA256

      ac9d7db6626843e5577ed3cfd627e96091b70a3fff21369e4b26f51554eeaf78

    • SHA512

      724ed02e5985d80fee87e19fe7fb73f51e74e58df02900c59c916b94e1a5b9c8082c6700c2fc71fdf620c6cbfcae0776bd1bd9bf253c9c1de7d0e2cc39f4d923

    • SSDEEP

      6144:aWKg4vCS9iocEDzogURsxLPH1wvR19SrIya/35VJRjjhow8Iyc:Noc0zogUiZw518rg/vaw7

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks