General

  • Target

    wurod.ocx

  • Size

    764KB

  • Sample

    240926-h4z2ssxcka

  • MD5

    b9047a916a40b1c4e0033bba961f90e5

  • SHA1

    557c945813815eb7b0a74b3bdbfa53a20139838a

  • SHA256

    30b2392656573d4fc71a198bea4eb089047a6f21c2db7b163bcab3b1c686be3f

  • SHA512

    54762cf3769b4149cea1a495a59b1c51d3db77d1d67b51249bc79806b49808335ce9a5274370ad785d17979ef97cb58cd2024fdc2e2453a260f5eeafa0f0ddc2

  • SSDEEP

    12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSrjNwgraKRT61cKGNx:S4DzZKnH4GRGY61WN+

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

209.250.246.206:443

110.232.117.186:8080

164.68.99.3:8080

119.193.124.41:7080

212.237.17.99:8080

107.182.225.142:8080

185.8.212.130:7080

153.126.146.25:7080

77.81.247.144:8080

209.126.98.206:8080

201.94.166.162:443

131.100.24.231:80

45.235.8.30:8080

213.241.20.155:443

103.43.46.182:443

129.232.188.93:443

103.132.242.26:8080

151.106.112.196:8080

45.118.115.99:8080

185.4.135.165:8080

ecs1.plain
eck1.plain

Targets

    • Target

      wurod.ocx

    • Size

      764KB

    • MD5

      b9047a916a40b1c4e0033bba961f90e5

    • SHA1

      557c945813815eb7b0a74b3bdbfa53a20139838a

    • SHA256

      30b2392656573d4fc71a198bea4eb089047a6f21c2db7b163bcab3b1c686be3f

    • SHA512

      54762cf3769b4149cea1a495a59b1c51d3db77d1d67b51249bc79806b49808335ce9a5274370ad785d17979ef97cb58cd2024fdc2e2453a260f5eeafa0f0ddc2

    • SSDEEP

      12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSrjNwgraKRT61cKGNx:S4DzZKnH4GRGY61WN+

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Matrix

Tasks