General

  • Target

    5826fef7bc5f8eeff6300703b011c15e60445f7aeefb618f7a2f319210cbb31b

  • Size

    619KB

  • Sample

    241113-xfyldszrhm

  • MD5

    3259d08847b1483cadaf2f29ae848f5a

  • SHA1

    5c93dcb09bff9f58cbe2de3b645430486ed73ff6

  • SHA256

    5826fef7bc5f8eeff6300703b011c15e60445f7aeefb618f7a2f319210cbb31b

  • SHA512

    5015e9731f34cab5112b02f63b44f17e1c8c4509a2095d727e9469f9f76d25962a958fae37ccb597003a2f3eedef17cffe26b3b7b8ef8b3968861ff70aa6f606

  • SSDEEP

    12288:sUjZuoYh77pG4EPogTcvhQjMp4rtBJ/eofcDU/tjad:sBNhvpDXZ2MCJ/eo0ytad

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

194.166.147.143:80

188.226.165.170:8080

188.40.170.197:80

51.38.50.144:8080

85.75.49.113:80

103.229.73.17:8080

190.117.101.56:80

172.96.190.154:8080

223.17.215.76:80

5.2.246.108:80

190.85.46.52:7080

95.76.142.243:80

86.123.55.0:80

103.93.220.182:80

212.198.71.39:80

153.229.219.1:443

139.59.61.215:443

5.79.70.250:8080

190.192.39.136:80

178.33.167.120:8080

rsa_pubkey.plain

Targets

    • Target

      5826fef7bc5f8eeff6300703b011c15e60445f7aeefb618f7a2f319210cbb31b

    • Size

      619KB

    • MD5

      3259d08847b1483cadaf2f29ae848f5a

    • SHA1

      5c93dcb09bff9f58cbe2de3b645430486ed73ff6

    • SHA256

      5826fef7bc5f8eeff6300703b011c15e60445f7aeefb618f7a2f319210cbb31b

    • SHA512

      5015e9731f34cab5112b02f63b44f17e1c8c4509a2095d727e9469f9f76d25962a958fae37ccb597003a2f3eedef17cffe26b3b7b8ef8b3968861ff70aa6f606

    • SSDEEP

      12288:sUjZuoYh77pG4EPogTcvhQjMp4rtBJ/eofcDU/tjad:sBNhvpDXZ2MCJ/eo0ytad

MITRE ATT&CK Enterprise v15

Tasks