General

  • Target

    4ab46cc1b4ce13ebbb68850b2dee47cdc7fc2075b284e0525fa820e6a1fab14e

  • Size

    515KB

  • Sample

    241113-v9x6lswfjg

  • MD5

    f292e5f3ec9bbc01376b5891f2b7a8cd

  • SHA1

    e8016ce53804588c2172620cceaa71163124992b

  • SHA256

    4ab46cc1b4ce13ebbb68850b2dee47cdc7fc2075b284e0525fa820e6a1fab14e

  • SHA512

    5c05dd28ad4c425864ac142206ee68b0542894df0c05caaa78ca93da126590598c10ad3ebda650a34c0ee00fe52ad5445d3e49eec2301868869955af4a8470bb

  • SSDEEP

    12288:4eKttBk3V7OHY7UVJNqzJvITOmKTd1N3LaPB9d9:4eUMi4wNqzJQTOmKTd1NIt

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

175.107.196.192:80

156.67.219.84:7080

159.8.59.82:8080

119.235.255.201:8080

31.24.158.56:8080

212.237.17.99:8080

45.118.135.203:7080

45.176.232.124:443

129.232.188.93:443

58.227.42.236:80

162.214.50.39:7080

176.104.106.96:8080

153.126.203.229:8080

162.243.175.63:443

138.185.72.26:8080

50.116.54.215:443

50.30.40.196:8080

178.79.147.66:8080

203.114.109.124:443

82.165.152.127:8080

eck1.plain
ecs1.plain

Targets

    • Target

      f8e47164a1541097b4b346725bf5e52e33f00b2c023b9bf6e8e7fe11893ed62e

    • Size

      1.1MB

    • MD5

      dc2af460d022d1854363cbd87a6e4d0c

    • SHA1

      5f27b0754da7a4f1b1c162fc5a22b5e92520b23a

    • SHA256

      f8e47164a1541097b4b346725bf5e52e33f00b2c023b9bf6e8e7fe11893ed62e

    • SHA512

      9c241c495245e6013de05a88ff5789a508c2b42a4681c48cad51487311760063eebdd44b9764d9c1e05d89dd93c735f205b200844e4f0eb00492c97fb05b40e1

    • SSDEEP

      12288:hxhQ0pWageSXJ0JF0EdcDZKh8SbCpdNSTEMJdHuN3LafJSrN:hDQhXJ1Td2CpdNST/uNEsN

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet family

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks