General

  • Target

    8999e081d259769a981dec5fdf067736f7479404245dbb7fadc5e5fef63c9b80

  • Size

    252KB

  • Sample

    241120-xaa8xa1mcw

  • MD5

    05e3393dbc0ef74c85fcae9eb878d6bb

  • SHA1

    91bf26902fdeb2b1d725504a15ca4b5d26d0357c

  • SHA256

    8999e081d259769a981dec5fdf067736f7479404245dbb7fadc5e5fef63c9b80

  • SHA512

    2c59af60ef91b355c97fa732b4aa571de62d649f868bcebc1988d28cfdb1391269e0b30854e923c5b9f91fe25383a9fa96546ddfe8a0211a3f478329e6b682b8

  • SSDEEP

    6144:ndH09uYgR7OJSuwuZc2HEaYTy7beWTBdDm:dHJtlec2HEaYTXWT/a

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

91.200.186.228:443

191.252.196.221:8080

94.177.248.64:443

66.42.55.5:7080

103.8.26.103:8080

185.184.25.237:8080

103.8.26.102:8080

178.79.147.66:8080

58.227.42.236:80

45.118.135.203:7080

103.75.201.2:443

195.154.133.20:443

45.142.114.231:8080

212.237.5.209:443

207.38.84.195:8080

104.251.214.46:8080

212.237.17.99:8080

212.237.56.116:7080

216.158.226.206:443

110.232.117.186:8080

eck1.plain
ecs1.plain

Targets

    • Target

      8999e081d259769a981dec5fdf067736f7479404245dbb7fadc5e5fef63c9b80

    • Size

      252KB

    • MD5

      05e3393dbc0ef74c85fcae9eb878d6bb

    • SHA1

      91bf26902fdeb2b1d725504a15ca4b5d26d0357c

    • SHA256

      8999e081d259769a981dec5fdf067736f7479404245dbb7fadc5e5fef63c9b80

    • SHA512

      2c59af60ef91b355c97fa732b4aa571de62d649f868bcebc1988d28cfdb1391269e0b30854e923c5b9f91fe25383a9fa96546ddfe8a0211a3f478329e6b682b8

    • SSDEEP

      6144:ndH09uYgR7OJSuwuZc2HEaYTy7beWTBdDm:dHJtlec2HEaYTXWT/a

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet family

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks