General

  • Target

    10ecdb3f80569ce42b7a29bb36f81f68c6e17bff7cb8c548f7c232994032ca6a

  • Size

    174KB

  • Sample

    241113-vvm24awdme

  • MD5

    8d4599b088b609a84f1f2744ea1a399e

  • SHA1

    f0bfb4fae05e203030079d31e9d6eadea8d924e9

  • SHA256

    10ecdb3f80569ce42b7a29bb36f81f68c6e17bff7cb8c548f7c232994032ca6a

  • SHA512

    d713e9939e586440c389e1012a60f4076189045d418b1f063126604e06a505ef9ef285a77256270c763d446ccec99fc010030910a5796983a1291f1b1e1b0266

  • SSDEEP

    3072:5AYnGS6+1ZcqrMsVOeKSJYv8m+sVrsTGhB/BDE9aVDZ:5AnSb1X4sVOeKSJ+X7hB/dFV

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

74.58.215.226:80

24.164.79.147:8080

157.245.123.197:8080

50.116.111.59:8080

173.249.20.233:443

78.188.225.105:80

75.177.207.146:80

136.244.110.184:8080

194.190.67.75:80

70.92.118.112:80

110.145.101.66:443

194.4.58.192:7080

217.20.166.178:7080

109.74.5.95:8080

110.145.11.73:80

66.57.108.14:443

78.189.148.42:80

144.217.7.207:7080

120.150.60.189:80

37.139.21.175:8080

rsa_pubkey.plain

Targets

    • Target

      10ecdb3f80569ce42b7a29bb36f81f68c6e17bff7cb8c548f7c232994032ca6a

    • Size

      174KB

    • MD5

      8d4599b088b609a84f1f2744ea1a399e

    • SHA1

      f0bfb4fae05e203030079d31e9d6eadea8d924e9

    • SHA256

      10ecdb3f80569ce42b7a29bb36f81f68c6e17bff7cb8c548f7c232994032ca6a

    • SHA512

      d713e9939e586440c389e1012a60f4076189045d418b1f063126604e06a505ef9ef285a77256270c763d446ccec99fc010030910a5796983a1291f1b1e1b0266

    • SSDEEP

      3072:5AYnGS6+1ZcqrMsVOeKSJYv8m+sVrsTGhB/BDE9aVDZ:5AnSb1X4sVOeKSJ+X7hB/dFV

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet family

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks