General

  • Target

    2024-08-31_4d7066530b512e09c5228c4679278843_icedid

  • Size

    424KB

  • Sample

    240901-aev3jstdke

  • MD5

    4d7066530b512e09c5228c4679278843

  • SHA1

    7aa7731541e8c271ac7d102182f98f726a0d1ba6

  • SHA256

    43cb0b20f473679b534850492df641d2f1b8406803636c947bf6018f938e1d75

  • SHA512

    65f4ff18c92deb13abbe401adc8f6812071ce322a2102c27cf569cb6c877597dbd11986bd4ea9d0ce093547ff871c21858bacc8a5aea03f01fb98484c4236392

  • SSDEEP

    6144:iabhjkzVozlLRGrqiFY8qf730XXpcDZTNY/D4UnIFzgBEPdidfwR:iYhIzVqLRsqT73K0a/sGMwEPdih

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

49.243.9.118:80

162.241.41.111:7080

190.85.46.52:7080

162.144.42.60:8080

157.245.138.101:7080

103.133.66.57:443

167.71.227.113:8080

80.200.62.81:20

78.186.65.230:80

185.142.236.163:443

78.114.175.216:80

202.166.170.43:80

37.205.9.252:7080

118.243.83.70:80

116.202.10.123:8080

223.135.30.189:80

120.51.34.254:80

139.59.61.215:443

8.4.9.137:8080

202.153.220.157:80

rsa_pubkey.plain

Targets

    • Target

      2024-08-31_4d7066530b512e09c5228c4679278843_icedid

    • Size

      424KB

    • MD5

      4d7066530b512e09c5228c4679278843

    • SHA1

      7aa7731541e8c271ac7d102182f98f726a0d1ba6

    • SHA256

      43cb0b20f473679b534850492df641d2f1b8406803636c947bf6018f938e1d75

    • SHA512

      65f4ff18c92deb13abbe401adc8f6812071ce322a2102c27cf569cb6c877597dbd11986bd4ea9d0ce093547ff871c21858bacc8a5aea03f01fb98484c4236392

    • SSDEEP

      6144:iabhjkzVozlLRGrqiFY8qf730XXpcDZTNY/D4UnIFzgBEPdidfwR:iYhIzVqLRsqT73K0a/sGMwEPdih

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Enterprise v15

Tasks