General

  • Target

    aae2e333f3e21b9bf1670aea4509e5b996e28c9084d1cc1cbb6082820f4c0b2c

  • Size

    209KB

  • Sample

    241120-3cqn9swflk

  • MD5

    a43397d8ca66274574b6b52fe2a184f5

  • SHA1

    c3ebe8074be38f507f80af027b0bdce44b549de7

  • SHA256

    aae2e333f3e21b9bf1670aea4509e5b996e28c9084d1cc1cbb6082820f4c0b2c

  • SHA512

    a4f4edd5eb5ffd8d63232ca0d65497726953a9f3b29b0ffc884eedf23a02611d81009b48202d2cfafae4b930bc228540c23836b42e6af1e888e268b2db1fd1c6

  • SSDEEP

    3072:MVaYmiLp+AO2e0qvDs+/Vy+29S9b+WWbyTOn5rnJRsMiQF0Vd9EkuejapPs:ymIYAO2e6vX9jbR53RFg+ejaF

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

74.58.215.226:80

24.164.79.147:8080

157.245.123.197:8080

50.116.111.59:8080

173.249.20.233:443

78.188.225.105:80

75.177.207.146:80

136.244.110.184:8080

194.190.67.75:80

70.92.118.112:80

110.145.101.66:443

194.4.58.192:7080

217.20.166.178:7080

109.74.5.95:8080

110.145.11.73:80

66.57.108.14:443

78.189.148.42:80

144.217.7.207:7080

120.150.60.189:80

37.139.21.175:8080

rsa_pubkey.plain

Targets

    • Target

      aae2e333f3e21b9bf1670aea4509e5b996e28c9084d1cc1cbb6082820f4c0b2c

    • Size

      209KB

    • MD5

      a43397d8ca66274574b6b52fe2a184f5

    • SHA1

      c3ebe8074be38f507f80af027b0bdce44b549de7

    • SHA256

      aae2e333f3e21b9bf1670aea4509e5b996e28c9084d1cc1cbb6082820f4c0b2c

    • SHA512

      a4f4edd5eb5ffd8d63232ca0d65497726953a9f3b29b0ffc884eedf23a02611d81009b48202d2cfafae4b930bc228540c23836b42e6af1e888e268b2db1fd1c6

    • SSDEEP

      3072:MVaYmiLp+AO2e0qvDs+/Vy+29S9b+WWbyTOn5rnJRsMiQF0Vd9EkuejapPs:ymIYAO2e6vX9jbR53RFg+ejaF

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet family

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks