General

  • Target

    fd0deb72554d2681e0e96785845f646624d1ecedad2226d3d21ad35426abda9d

  • Size

    174KB

  • Sample

    241121-a9jb8swhpf

  • MD5

    4c86fa29095bca124eb5adda29626ba4

  • SHA1

    09b0cc75535fa172607c5da5f6c6d000707ec961

  • SHA256

    fd0deb72554d2681e0e96785845f646624d1ecedad2226d3d21ad35426abda9d

  • SHA512

    d8687adc1d08713c7ad73e404a6c301153c5d31f1b9b0aad40c31a0a4ebf1e3ea25a6300056a2f19f47e1bc29ceb1e7580446a0492c78496672d266cd9c6b7fc

  • SSDEEP

    3072:5AYnGS6+1acqrMsVOeKSJYv8m+sVrsTGhB/BDE9aVDZ:5AnSb1Q4sVOeKSJ+X7hB/dFV

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

74.58.215.226:80

24.164.79.147:8080

157.245.123.197:8080

50.116.111.59:8080

173.249.20.233:443

78.188.225.105:80

75.177.207.146:80

136.244.110.184:8080

194.190.67.75:80

70.92.118.112:80

110.145.101.66:443

194.4.58.192:7080

217.20.166.178:7080

109.74.5.95:8080

110.145.11.73:80

66.57.108.14:443

78.189.148.42:80

144.217.7.207:7080

120.150.60.189:80

37.139.21.175:8080

rsa_pubkey.plain

Targets

    • Target

      fd0deb72554d2681e0e96785845f646624d1ecedad2226d3d21ad35426abda9d

    • Size

      174KB

    • MD5

      4c86fa29095bca124eb5adda29626ba4

    • SHA1

      09b0cc75535fa172607c5da5f6c6d000707ec961

    • SHA256

      fd0deb72554d2681e0e96785845f646624d1ecedad2226d3d21ad35426abda9d

    • SHA512

      d8687adc1d08713c7ad73e404a6c301153c5d31f1b9b0aad40c31a0a4ebf1e3ea25a6300056a2f19f47e1bc29ceb1e7580446a0492c78496672d266cd9c6b7fc

    • SSDEEP

      3072:5AYnGS6+1acqrMsVOeKSJYv8m+sVrsTGhB/BDE9aVDZ:5AnSb1Q4sVOeKSJ+X7hB/dFV

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet family

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks