General

  • Target

    badc484f79d9b7aa9d30a8d16c945a968fd0d1a5aaf43b21f0794da9ed612742

  • Size

    552KB

  • Sample

    191212-mhsjzmbfhs

  • MD5

    2bf73f302f0b30532c4198e3b7aabe07

  • SHA1

    4d6d8de1ba8a1a0e8711569b395bd87a06f069e3

  • SHA256

    badc484f79d9b7aa9d30a8d16c945a968fd0d1a5aaf43b21f0794da9ed612742

  • SHA512

    cdf6e93c4e1a3cbfb1d2e4fe0512606273df6660c1698bb3ad5d9fec6eb00ec560e37895eca0cb4feeb1e9abd2cfeda5ee985f1a1071b2f93338275335fc2073

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

110.143.84.202:80

75.80.148.244:80

64.53.242.181:8080

37.59.24.177:8080

66.34.201.20:7080

108.179.206.219:8080

45.56.88.91:443

206.189.112.148:8080

211.63.71.72:8080

178.210.51.222:8080

92.186.52.193:80

195.244.215.206:80

2.38.99.79:80

37.157.194.134:443

206.81.10.215:8080

80.21.182.46:80

80.11.163.139:21

190.56.255.118:80

190.226.44.20:21

173.70.81.77:80

rsa_pubkey.plain

Targets

    • Target

      badc484f79d9b7aa9d30a8d16c945a968fd0d1a5aaf43b21f0794da9ed612742

    • Size

      552KB

    • MD5

      2bf73f302f0b30532c4198e3b7aabe07

    • SHA1

      4d6d8de1ba8a1a0e8711569b395bd87a06f069e3

    • SHA256

      badc484f79d9b7aa9d30a8d16c945a968fd0d1a5aaf43b21f0794da9ed612742

    • SHA512

      cdf6e93c4e1a3cbfb1d2e4fe0512606273df6660c1698bb3ad5d9fec6eb00ec560e37895eca0cb4feeb1e9abd2cfeda5ee985f1a1071b2f93338275335fc2073

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Tasks