General

  • Target

    140072a3257b8ceb3a9104c51da45a2bc5e7a580bba7663becc8764995449d28

  • Size

    398KB

  • Sample

    241112-1v2s5s1mfy

  • MD5

    1e1c84c25448a59af67921a7f98eed3b

  • SHA1

    7f0d82b63700554095947b3b5166d6dd3eda6088

  • SHA256

    140072a3257b8ceb3a9104c51da45a2bc5e7a580bba7663becc8764995449d28

  • SHA512

    ae6267ddfcc01e7f1ab4708133b8aa24da903b7fa541730882e5d9d7943ac1d56c17ec359b4360fada93ba3f41977025f4ba11449dd1bbabfa94f510b4f00ff7

  • SSDEEP

    6144:8Y2DYQ3CcmVDdFORvgu6wpjk8y8yEmDNfa0wjWXjYZN4c:8YHQycm1ORvg9GjkB3wOm

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

189.34.18.252:8080

189.211.214.19:443

203.157.152.9:7080

157.245.145.87:443

195.159.28.244:8080

202.29.237.113:8080

203.56.191.129:8080

46.32.229.152:8080

103.229.72.197:8080

190.194.12.132:80

157.7.164.178:8081

117.2.139.117:443

183.91.3.63:80

177.254.134.180:80

24.245.65.66:80

223.17.215.76:80

27.78.27.110:443

46.105.131.68:8080

79.133.6.236:8080

58.27.215.3:8080

rsa_pubkey.plain

Targets

    • Target

      140072a3257b8ceb3a9104c51da45a2bc5e7a580bba7663becc8764995449d28

    • Size

      398KB

    • MD5

      1e1c84c25448a59af67921a7f98eed3b

    • SHA1

      7f0d82b63700554095947b3b5166d6dd3eda6088

    • SHA256

      140072a3257b8ceb3a9104c51da45a2bc5e7a580bba7663becc8764995449d28

    • SHA512

      ae6267ddfcc01e7f1ab4708133b8aa24da903b7fa541730882e5d9d7943ac1d56c17ec359b4360fada93ba3f41977025f4ba11449dd1bbabfa94f510b4f00ff7

    • SSDEEP

      6144:8Y2DYQ3CcmVDdFORvgu6wpjk8y8yEmDNfa0wjWXjYZN4c:8YHQycm1ORvg9GjkB3wOm

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet family

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks