General

  • Target

    7c405e73092326b269ac8f8f5f506ac0N

  • Size

    209KB

  • Sample

    240909-q2qdks1dkp

  • MD5

    7c405e73092326b269ac8f8f5f506ac0

  • SHA1

    15d9f68a66f07b38efc4acc46eebbe06ed59d7bb

  • SHA256

    014f84e61eadbec2b67e2bf14c5ac46a0b0470961ec1ee40ab3572a92184b2e4

  • SHA512

    b299d63c7ebeeb86815ac0952f35ecb40afe2b98541d4f910f2ef5fd85d17f3a493548565a77c1b48daa9bc77a8ef42eae8ae1503516bcda728b5991e7e2317a

  • SSDEEP

    3072:MVaYmiLp+AO2e0qGDs+/Vy+29S9b+WWbyTOn5rnJRsMiQF0Vd9EkuejapPs:ymIYAO2e1vX9jbR53RFg+ejaF

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

74.58.215.226:80

24.164.79.147:8080

157.245.123.197:8080

50.116.111.59:8080

173.249.20.233:443

78.188.225.105:80

75.177.207.146:80

136.244.110.184:8080

194.190.67.75:80

70.92.118.112:80

110.145.101.66:443

194.4.58.192:7080

217.20.166.178:7080

109.74.5.95:8080

110.145.11.73:80

66.57.108.14:443

78.189.148.42:80

144.217.7.207:7080

120.150.60.189:80

37.139.21.175:8080

rsa_pubkey.plain

Targets

    • Target

      7c405e73092326b269ac8f8f5f506ac0N

    • Size

      209KB

    • MD5

      7c405e73092326b269ac8f8f5f506ac0

    • SHA1

      15d9f68a66f07b38efc4acc46eebbe06ed59d7bb

    • SHA256

      014f84e61eadbec2b67e2bf14c5ac46a0b0470961ec1ee40ab3572a92184b2e4

    • SHA512

      b299d63c7ebeeb86815ac0952f35ecb40afe2b98541d4f910f2ef5fd85d17f3a493548565a77c1b48daa9bc77a8ef42eae8ae1503516bcda728b5991e7e2317a

    • SSDEEP

      3072:MVaYmiLp+AO2e0qGDs+/Vy+29S9b+WWbyTOn5rnJRsMiQF0Vd9EkuejapPs:ymIYAO2e1vX9jbR53RFg+ejaF

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Blocklisted process makes network request

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks