General

  • Target

    5a80d615da0e92359916378d8cf8359c59386fe36036d4d669e0857629e5a744

  • Size

    391KB

  • Sample

    241121-bagj2a1rcp

  • MD5

    b19a4829cf69cbbea0b0f539e0f8bd91

  • SHA1

    cc8ffcbcfebd00a8551307dbb950620562a35077

  • SHA256

    5a80d615da0e92359916378d8cf8359c59386fe36036d4d669e0857629e5a744

  • SHA512

    1013cd4815f2f14c5cbf02553bec73ae4943481beb5a0e3c1d0845d4746b6dc4f3381e3c22f4bb4461428c8b29c28edb2f5ced76026cac9bccb3ff925b6ff002

  • SSDEEP

    6144:lonAnCcw9tV+RfOu6Ypj0uwfCPZfzdkfL0PqKH7BG15ec:lonACcwR+RfOdej0hfCPZfz+fur7mx

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

24.231.88.85:80

191.112.178.60:80

50.116.111.59:8080

173.249.20.233:443

188.165.214.98:8080

74.40.205.197:443

62.75.141.82:80

2.58.16.89:8080

188.219.31.12:80

95.213.236.64:8080

72.186.136.247:443

185.201.9.197:8080

203.153.216.189:7080

202.134.4.216:8080

72.229.97.235:80

24.179.13.119:80

174.118.202.24:443

74.208.45.104:8080

51.89.36.180:443

202.141.243.254:443

rsa_pubkey.plain

Targets

    • Target

      5a80d615da0e92359916378d8cf8359c59386fe36036d4d669e0857629e5a744

    • Size

      391KB

    • MD5

      b19a4829cf69cbbea0b0f539e0f8bd91

    • SHA1

      cc8ffcbcfebd00a8551307dbb950620562a35077

    • SHA256

      5a80d615da0e92359916378d8cf8359c59386fe36036d4d669e0857629e5a744

    • SHA512

      1013cd4815f2f14c5cbf02553bec73ae4943481beb5a0e3c1d0845d4746b6dc4f3381e3c22f4bb4461428c8b29c28edb2f5ced76026cac9bccb3ff925b6ff002

    • SSDEEP

      6144:lonAnCcw9tV+RfOu6Ypj0uwfCPZfzdkfL0PqKH7BG15ec:lonACcwR+RfOdej0hfCPZfz+fur7mx

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet family

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks