General

  • Target

    828eb47ed98a8ed36bba74d389132621fa84bb8269b679145ba256ed644e67bd

  • Size

    765KB

  • Sample

    240902-awcmjaxcka

  • MD5

    4ddda4a34e43f0f4ae480744279a9636

  • SHA1

    35d95c59d50aa4a5ff1921c02d5a28dd25122869

  • SHA256

    828eb47ed98a8ed36bba74d389132621fa84bb8269b679145ba256ed644e67bd

  • SHA512

    95199a43701d1feeca5467da3d87aea6490101c39fbb3e9cbfbdafd7ba643b851a8672e8585f39bd0d504cbe7945b7dc71ff33b8cb8a3152b152ad46a061bd4c

  • SSDEEP

    12288:kTkn1g4i3Z1ba0ok3AfwlcwFP90ws7YbJmfhTXZQaLY+XbHiYD:kTyg4i3uhsP9Zs7oJmfhTpQB+XbH

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

190.96.15.50:80

192.175.111.214:8080

95.85.33.23:8080

192.232.229.54:7080

200.127.14.97:80

190.188.245.242:80

51.15.7.145:80

138.97.60.140:8080

98.13.75.196:80

213.52.74.198:80

74.58.215.226:80

192.81.38.31:80

191.182.6.118:80

212.71.237.140:8080

209.236.123.42:8080

60.93.23.51:80

178.211.45.66:8080

190.24.243.186:80

62.84.75.50:80

50.121.220.50:80

rsa_pubkey.plain

Targets

    • Target

      828eb47ed98a8ed36bba74d389132621fa84bb8269b679145ba256ed644e67bd

    • Size

      765KB

    • MD5

      4ddda4a34e43f0f4ae480744279a9636

    • SHA1

      35d95c59d50aa4a5ff1921c02d5a28dd25122869

    • SHA256

      828eb47ed98a8ed36bba74d389132621fa84bb8269b679145ba256ed644e67bd

    • SHA512

      95199a43701d1feeca5467da3d87aea6490101c39fbb3e9cbfbdafd7ba643b851a8672e8585f39bd0d504cbe7945b7dc71ff33b8cb8a3152b152ad46a061bd4c

    • SSDEEP

      12288:kTkn1g4i3Z1ba0ok3AfwlcwFP90ws7YbJmfhTXZQaLY+XbHiYD:kTyg4i3uhsP9Zs7oJmfhTpQB+XbH

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Enterprise v15

Tasks