General

  • Target

    22892a9d77bdd427b199b7b47a20133ade01bf2a8627265713f85e1d5edbeb69

  • Size

    438KB

  • Sample

    241112-1ncknsvpek

  • MD5

    f6e25275b551f156e135b613d4b4dbe0

  • SHA1

    2b3cecb6d87aa39dd72159700acebc0379e26101

  • SHA256

    22892a9d77bdd427b199b7b47a20133ade01bf2a8627265713f85e1d5edbeb69

  • SHA512

    2e30f3f7cdfc735b4b3084cd98d2653efc1323f366d0159e201a0484fc631c392a3a0794483cf301b4b9fcba4025296bbe87c1b71ffc27e79b929920227fe306

  • SSDEEP

    12288:W40je21huDiqirIXREi+SoOJITmR6ObY/Yu5cOiFKOMldIse1mSCQ:W4+x1MEiFjXR6+Y/wFlMcseISV

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

189.34.18.252:8080

189.211.214.19:443

203.157.152.9:7080

157.245.145.87:443

195.159.28.244:8080

202.29.237.113:8080

203.56.191.129:8080

46.32.229.152:8080

103.229.72.197:8080

190.194.12.132:80

157.7.164.178:8081

117.2.139.117:443

183.91.3.63:80

177.254.134.180:80

24.245.65.66:80

223.17.215.76:80

27.78.27.110:443

46.105.131.68:8080

79.133.6.236:8080

58.27.215.3:8080

rsa_pubkey.plain

Targets

    • Target

      22892a9d77bdd427b199b7b47a20133ade01bf2a8627265713f85e1d5edbeb69

    • Size

      438KB

    • MD5

      f6e25275b551f156e135b613d4b4dbe0

    • SHA1

      2b3cecb6d87aa39dd72159700acebc0379e26101

    • SHA256

      22892a9d77bdd427b199b7b47a20133ade01bf2a8627265713f85e1d5edbeb69

    • SHA512

      2e30f3f7cdfc735b4b3084cd98d2653efc1323f366d0159e201a0484fc631c392a3a0794483cf301b4b9fcba4025296bbe87c1b71ffc27e79b929920227fe306

    • SSDEEP

      12288:W40je21huDiqirIXREi+SoOJITmR6ObY/Yu5cOiFKOMldIse1mSCQ:W4+x1MEiFjXR6+Y/wFlMcseISV

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet family

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks