General

  • Target

    c34d93af69c25515b4b4768ae3cf75ac90af408fff4b45f3c7278b31588fdb7c

  • Size

    414KB

  • Sample

    200114-fqheytt8bj

  • MD5

    ef6f4f1e49fb3c5fec4a50c8ca4f8b18

  • SHA1

    4412ff91d8d15fcdb8a19c9660f45be9c06bf178

  • SHA256

    c34d93af69c25515b4b4768ae3cf75ac90af408fff4b45f3c7278b31588fdb7c

  • SHA512

    56914515f8d3e821a3ccc85f211e7044897163d9766a5b328e54798c3b68f388adeda1e40e739710f0eb6d8e8b6d9d0b9f75d3a9bc4dc7a8fb8e630e90b80db1

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

76.185.136.132:80

165.255.142.118:80

186.147.245.204:80

198.58.112.7:443

143.95.101.72:8080

91.205.173.150:8080

124.150.175.133:80

51.77.113.97:8080

181.54.246.80:443

1.221.254.82:80

89.215.225.15:80

75.127.14.170:8080

160.226.171.255:443

182.187.137.199:8080

196.6.119.137:80

77.74.78.80:443

190.93.210.113:80

95.130.37.244:443

37.46.129.215:8080

114.179.127.48:80

rsa_pubkey.plain

Targets

    • Target

      c34d93af69c25515b4b4768ae3cf75ac90af408fff4b45f3c7278b31588fdb7c

    • Size

      414KB

    • MD5

      ef6f4f1e49fb3c5fec4a50c8ca4f8b18

    • SHA1

      4412ff91d8d15fcdb8a19c9660f45be9c06bf178

    • SHA256

      c34d93af69c25515b4b4768ae3cf75ac90af408fff4b45f3c7278b31588fdb7c

    • SHA512

      56914515f8d3e821a3ccc85f211e7044897163d9766a5b328e54798c3b68f388adeda1e40e739710f0eb6d8e8b6d9d0b9f75d3a9bc4dc7a8fb8e630e90b80db1

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks