General

  • Target

    954187de69a83fc226a89b2dde4e8711e2bf798345a6ffce753575a9f59c3ac9

  • Size

    387KB

  • Sample

    241113-v8kh5awerb

  • MD5

    b5c528e01a18f44b6a85feb67b9c9873

  • SHA1

    ed0874a6250d49033127ded21632d8a1b2467dbd

  • SHA256

    954187de69a83fc226a89b2dde4e8711e2bf798345a6ffce753575a9f59c3ac9

  • SHA512

    885991621fba2f7e5dd4df066abc5905f808cfb7b9b395b4cc65fb59b9e39c5b877c545343a6be0bc26d0642dfda0e084a83b2c94146f79d8edd6f155a2ab762

  • SSDEEP

    6144:CwIvZ/5nGwDn6I6EPGQveBIleSAcAScmj67c8xkvFERVm1WxvgrLC:VoZ9nPGQveMe0vj67c5WNxvOLC

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

51.178.61.60:443

168.197.250.14:80

45.79.33.48:8080

196.44.98.190:8080

177.72.80.14:7080

51.210.242.234:8080

185.148.169.10:8080

142.4.219.173:8080

78.47.204.80:443

78.46.73.125:443

37.44.244.177:8080

37.59.209.141:8080

191.252.103.16:80

54.38.242.185:443

85.214.67.203:8080

54.37.228.122:443

207.148.81.119:8080

195.77.239.39:8080

66.42.57.149:443

195.154.146.35:443

eck1.plain
ecs1.plain

Targets

    • Target

      954187de69a83fc226a89b2dde4e8711e2bf798345a6ffce753575a9f59c3ac9

    • Size

      387KB

    • MD5

      b5c528e01a18f44b6a85feb67b9c9873

    • SHA1

      ed0874a6250d49033127ded21632d8a1b2467dbd

    • SHA256

      954187de69a83fc226a89b2dde4e8711e2bf798345a6ffce753575a9f59c3ac9

    • SHA512

      885991621fba2f7e5dd4df066abc5905f808cfb7b9b395b4cc65fb59b9e39c5b877c545343a6be0bc26d0642dfda0e084a83b2c94146f79d8edd6f155a2ab762

    • SSDEEP

      6144:CwIvZ/5nGwDn6I6EPGQveBIleSAcAScmj67c8xkvFERVm1WxvgrLC:VoZ9nPGQveMe0vj67c5WNxvOLC

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet family

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks