General

  • Target

    cdc4f9db73ecc32b9ef422ceb9348c7b2af8dbc2c9dff9a510e7cf12b6fe7a37

  • Size

    171KB

  • Sample

    241120-znk2datepp

  • MD5

    b0ff8950aa9ead05855f6b307e80d2fa

  • SHA1

    d224da5627d7871d1a967bf929fa4d69151b72fb

  • SHA256

    cdc4f9db73ecc32b9ef422ceb9348c7b2af8dbc2c9dff9a510e7cf12b6fe7a37

  • SHA512

    fc8b3202db3a4082e2fded35074e673fa6cf131f613f858c5c81d9fd200cf3a667e96df15836113fa3182a2fab002f2b4c9e0d52e59c44739d78f3b7434b51bb

  • SSDEEP

    3072:kA4UBWAk53s5EcEjPNMEGHRAWCIQ3Xp4MOjAVOccz2kQZhXJbEfY:kA4FA2s5cDtORAZICpdVOxbKBJbEf

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

93.149.120.214:80

82.208.146.142:7080

138.197.99.250:8080

167.71.148.58:443

211.215.18.93:8080

185.94.252.27:443

70.32.84.74:8080

81.214.253.80:443

45.184.103.73:80

138.97.60.141:7080

191.241.233.198:80

209.236.123.42:8080

155.186.9.160:80

45.16.226.117:443

138.97.60.140:8080

192.232.229.54:7080

1.226.84.243:8080

190.64.88.186:443

46.105.114.137:8080

46.101.58.37:8080

rsa_pubkey.plain

Targets

    • Target

      cdc4f9db73ecc32b9ef422ceb9348c7b2af8dbc2c9dff9a510e7cf12b6fe7a37

    • Size

      171KB

    • MD5

      b0ff8950aa9ead05855f6b307e80d2fa

    • SHA1

      d224da5627d7871d1a967bf929fa4d69151b72fb

    • SHA256

      cdc4f9db73ecc32b9ef422ceb9348c7b2af8dbc2c9dff9a510e7cf12b6fe7a37

    • SHA512

      fc8b3202db3a4082e2fded35074e673fa6cf131f613f858c5c81d9fd200cf3a667e96df15836113fa3182a2fab002f2b4c9e0d52e59c44739d78f3b7434b51bb

    • SSDEEP

      3072:kA4UBWAk53s5EcEjPNMEGHRAWCIQ3Xp4MOjAVOccz2kQZhXJbEfY:kA4FA2s5cDtORAZICpdVOxbKBJbEf

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet family

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks