General

  • Target

    c19a014a1cdf25ec6441d305376dfe78b5c20ada7494fbc4aa2d6f68631df3d9.exe

  • Size

    460KB

  • Sample

    240821-cqmxesvgqg

  • MD5

    59287b19f7d85e749d19a57337103045

  • SHA1

    9de93499becd7a7501db4895d934d8792e7c91c8

  • SHA256

    c19a014a1cdf25ec6441d305376dfe78b5c20ada7494fbc4aa2d6f68631df3d9

  • SHA512

    655d2a9259a6d075320f18d46c5ba294504b9385a4b8533f79288c40a0b022cd7d6d35201336dfc0bbb5c0cf957e709b94feb1ee1402d1bff3668bd8163b7192

  • SSDEEP

    12288:UOps+brP/VgjVbKTrOhkfq8eKYmC3LC2:bs+vPN0b1ywLC2

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

88.153.35.32:80

107.170.146.252:8080

173.212.214.235:7080

167.114.153.111:8080

67.170.250.203:443

121.124.124.40:7080

103.86.49.11:8080

74.214.230.200:80

194.187.133.160:443

172.104.97.173:8080

172.91.208.86:80

200.116.145.225:443

202.134.4.216:8080

172.105.13.66:443

190.164.104.62:80

50.35.17.13:80

176.111.60.55:8080

201.241.127.190:80

66.76.12.94:8080

95.213.236.64:8080

rsa_pubkey.plain

Targets

    • Target

      c19a014a1cdf25ec6441d305376dfe78b5c20ada7494fbc4aa2d6f68631df3d9.exe

    • Size

      460KB

    • MD5

      59287b19f7d85e749d19a57337103045

    • SHA1

      9de93499becd7a7501db4895d934d8792e7c91c8

    • SHA256

      c19a014a1cdf25ec6441d305376dfe78b5c20ada7494fbc4aa2d6f68631df3d9

    • SHA512

      655d2a9259a6d075320f18d46c5ba294504b9385a4b8533f79288c40a0b022cd7d6d35201336dfc0bbb5c0cf957e709b94feb1ee1402d1bff3668bd8163b7192

    • SSDEEP

      12288:UOps+brP/VgjVbKTrOhkfq8eKYmC3LC2:bs+vPN0b1ywLC2

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Enterprise v15

Tasks