General

  • Target

    420a9982fc68c54a3e2fe86500e4d590N.exe

  • Size

    490KB

  • Sample

    240907-kf7svavenb

  • MD5

    420a9982fc68c54a3e2fe86500e4d590

  • SHA1

    6c39eb71d779629b530b34d867ccca424f69c010

  • SHA256

    612dfdfabc11cb685aefc825a2d5e9e3fa52f0cb6f13eb058d271637e9fa22b1

  • SHA512

    27267cc450b373f4535d191907ffdccd6a550496190c8f77f9a80e6e0974554060ae920c729071e8df010c83749b584be8d1ad37b6cbfd2f4fa7d5b1b5bc3cf8

  • SSDEEP

    12288:ZvqNS1cxs67noJVIZqOx0JcJjCZIBVvQy:yvN7n3RxelZ/

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

85.246.78.192:80

188.226.165.170:8080

188.40.170.197:80

51.38.50.144:8080

175.103.38.146:80

192.210.217.94:8080

180.23.53.200:80

202.29.237.113:8080

58.27.215.3:8080

190.85.46.52:7080

36.91.44.183:80

190.164.135.81:80

37.205.9.252:7080

192.241.220.183:8080

5.2.246.108:80

180.21.3.52:80

85.75.49.113:80

190.55.186.229:80

116.91.240.96:80

180.148.4.130:8080

rsa_pubkey.plain

Targets

    • Target

      420a9982fc68c54a3e2fe86500e4d590N.exe

    • Size

      490KB

    • MD5

      420a9982fc68c54a3e2fe86500e4d590

    • SHA1

      6c39eb71d779629b530b34d867ccca424f69c010

    • SHA256

      612dfdfabc11cb685aefc825a2d5e9e3fa52f0cb6f13eb058d271637e9fa22b1

    • SHA512

      27267cc450b373f4535d191907ffdccd6a550496190c8f77f9a80e6e0974554060ae920c729071e8df010c83749b584be8d1ad37b6cbfd2f4fa7d5b1b5bc3cf8

    • SSDEEP

      12288:ZvqNS1cxs67noJVIZqOx0JcJjCZIBVvQy:yvN7n3RxelZ/

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix ATT&CK v13

Discovery

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Tasks