General

  • Target

    d028bacfe329f42399835bd6b890f8de7f1a369bb932aa1e2508ea55bd9f2ae7

  • Size

    341KB

  • Sample

    241120-zjapvasene

  • MD5

    49d6f91d1622e6c2adb7e91506b505c0

  • SHA1

    a83ca6f6605294e5f2f9048f19e879a8c0e990dd

  • SHA256

    d028bacfe329f42399835bd6b890f8de7f1a369bb932aa1e2508ea55bd9f2ae7

  • SHA512

    228eae4427ba2bbc3823459e79d9d4cee251f20af1fc9be79f4c7fe8e15c29ed34a0e5dd5e99b8e5b9d3a869e2f357b6c924d5ffed13630fe6a6ba7d139cc230

  • SSDEEP

    6144:VaKGFRDWxCvoqDV8ZGU9Li0VBh0XjDLsLZCj8Hqd0u4LLF:4W1qGZbLV+IC4H11

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

173.68.199.157:80

59.148.253.194:8080

173.212.197.71:8080

98.103.204.12:443

2.45.176.233:80

45.33.77.42:8080

181.58.181.9:80

219.92.13.25:80

12.163.208.58:80

2.85.9.41:8080

172.104.169.32:8080

149.202.72.142:7080

189.223.16.99:80

216.47.196.104:80

191.97.154.2:80

213.197.182.158:8080

94.176.234.118:443

46.105.114.137:8080

177.144.130.105:8080

174.118.202.24:443

rsa_pubkey.plain

Targets

    • Target

      d028bacfe329f42399835bd6b890f8de7f1a369bb932aa1e2508ea55bd9f2ae7

    • Size

      341KB

    • MD5

      49d6f91d1622e6c2adb7e91506b505c0

    • SHA1

      a83ca6f6605294e5f2f9048f19e879a8c0e990dd

    • SHA256

      d028bacfe329f42399835bd6b890f8de7f1a369bb932aa1e2508ea55bd9f2ae7

    • SHA512

      228eae4427ba2bbc3823459e79d9d4cee251f20af1fc9be79f4c7fe8e15c29ed34a0e5dd5e99b8e5b9d3a869e2f357b6c924d5ffed13630fe6a6ba7d139cc230

    • SSDEEP

      6144:VaKGFRDWxCvoqDV8ZGU9Li0VBh0XjDLsLZCj8Hqd0u4LLF:4W1qGZbLV+IC4H11

MITRE ATT&CK Enterprise v15

Tasks