General

  • Target

    d80dc7946f1cf51c0407fa40e49ab84dab0cfa22494440a6e20a7cd06f52b32b

  • Size

    174KB

  • Sample

    241121-a9a1vsxkhv

  • MD5

    d4cc173a64ff19f2e6ef850fe796ea18

  • SHA1

    2ebff01bf6f2a3784e1cd5048c0aac0883e07347

  • SHA256

    d80dc7946f1cf51c0407fa40e49ab84dab0cfa22494440a6e20a7cd06f52b32b

  • SHA512

    923778b83441959e5119923a858a3d5c89a658f27b65419f7d2e3127f6c00dcc6414adbfc96b44ef9ff5f5f51909c1ce149c487cbc4955e5378a24fe3cd766bc

  • SSDEEP

    3072:5AYnGS6+16cqrMsVOeKSJYv8m+sVrsTGhB/BDE9aVDZ:5AnSb1w4sVOeKSJ+X7hB/dFV

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

74.58.215.226:80

24.164.79.147:8080

157.245.123.197:8080

50.116.111.59:8080

173.249.20.233:443

78.188.225.105:80

75.177.207.146:80

136.244.110.184:8080

194.190.67.75:80

70.92.118.112:80

110.145.101.66:443

194.4.58.192:7080

217.20.166.178:7080

109.74.5.95:8080

110.145.11.73:80

66.57.108.14:443

78.189.148.42:80

144.217.7.207:7080

120.150.60.189:80

37.139.21.175:8080

rsa_pubkey.plain

Targets

    • Target

      d80dc7946f1cf51c0407fa40e49ab84dab0cfa22494440a6e20a7cd06f52b32b

    • Size

      174KB

    • MD5

      d4cc173a64ff19f2e6ef850fe796ea18

    • SHA1

      2ebff01bf6f2a3784e1cd5048c0aac0883e07347

    • SHA256

      d80dc7946f1cf51c0407fa40e49ab84dab0cfa22494440a6e20a7cd06f52b32b

    • SHA512

      923778b83441959e5119923a858a3d5c89a658f27b65419f7d2e3127f6c00dcc6414adbfc96b44ef9ff5f5f51909c1ce149c487cbc4955e5378a24fe3cd766bc

    • SSDEEP

      3072:5AYnGS6+16cqrMsVOeKSJYv8m+sVrsTGhB/BDE9aVDZ:5AnSb1w4sVOeKSJ+X7hB/dFV

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet family

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks