General

  • Target

    0cb77254ee0cfd3e8967789c77af59cfde3f463d29bb13aa867735a8196eb8d5N.exe

  • Size

    320KB

  • Sample

    250107-scl1zawkev

  • MD5

    ae43e76b839522615e359145d6b21f40

  • SHA1

    e3f58d74e3c88f10ede48b8b533714d7aecaa39a

  • SHA256

    0cb77254ee0cfd3e8967789c77af59cfde3f463d29bb13aa867735a8196eb8d5

  • SHA512

    f001d41798421072e8e63cbbc1d5d5f93dc129a3c8001a447536a4ec1fb5fd02953a8778835043b73f02f30b1dd6253e44eee2396118c04619fcfe0cf4a5c77a

  • SSDEEP

    6144:SMeVGThcCLoa1BsQKJSjog73p6ekMpIK4L+vMtMK:SOLDlLog7YekMGDqv

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

188.157.101.114:80

192.175.111.214:8080

95.85.33.23:8080

192.232.229.54:7080

181.30.61.163:443

186.70.127.199:8090

200.127.14.97:80

70.169.17.134:80

24.232.228.233:80

172.104.169.32:8080

50.28.51.143:8080

177.73.0.98:443

149.202.72.142:7080

37.187.161.206:8080

202.29.239.162:443

213.197.182.158:8080

202.134.4.210:7080

190.24.243.186:80

201.213.177.139:80

105.209.235.113:8080

rsa_pubkey.plain

Targets

    • Target

      0cb77254ee0cfd3e8967789c77af59cfde3f463d29bb13aa867735a8196eb8d5N.exe

    • Size

      320KB

    • MD5

      ae43e76b839522615e359145d6b21f40

    • SHA1

      e3f58d74e3c88f10ede48b8b533714d7aecaa39a

    • SHA256

      0cb77254ee0cfd3e8967789c77af59cfde3f463d29bb13aa867735a8196eb8d5

    • SHA512

      f001d41798421072e8e63cbbc1d5d5f93dc129a3c8001a447536a4ec1fb5fd02953a8778835043b73f02f30b1dd6253e44eee2396118c04619fcfe0cf4a5c77a

    • SSDEEP

      6144:SMeVGThcCLoa1BsQKJSjog73p6ekMpIK4L+vMtMK:SOLDlLog7YekMGDqv

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet family

    • Emotet payload

      Detects Emotet payload in memory.

    • Dave packer

      Detects executable using a packer named 'Dave' by the community, based on a string at the end.

MITRE ATT&CK Enterprise v15

Tasks