General

  • Target

    SecuriteInfo.com.Trojan.DownLoader34.3377.7475.965

  • Size

    636KB

  • Sample

    200801-jz7mdazae2

  • MD5

    cb18333d0776b9993bf861d27753a87d

  • SHA1

    a4653ba5b59fe4937753f52084ec188ee6af1b0c

  • SHA256

    24a165d7c6ce42a827e515120c5253e3f8a0b085ed058283968444cec1c0d8de

  • SHA512

    7f4219f28d4297fa267314ca34f2bb4ee4a0ca36ffdadcb3cc83c41e4687e5c83e4f7fd2e22ba226598acb2048c655a89016b3446ab3854b8192f3f5ccdde528

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

71.208.216.10:80

212.51.142.238:8080

5.39.91.110:7080

109.74.5.95:8080

121.124.124.40:7080

139.130.242.43:80

162.241.92.219:8080

93.156.165.186:80

203.153.216.189:7080

169.239.182.217:8080

78.189.165.52:8080

37.187.72.193:8080

110.145.77.103:80

190.144.18.198:80

209.182.216.177:443

74.208.45.104:8080

209.141.54.221:8080

190.160.53.126:80

87.106.139.101:8080

176.111.60.55:8080

rsa_pubkey.plain

Targets

    • Target

      SecuriteInfo.com.Trojan.DownLoader34.3377.7475.965

    • Size

      636KB

    • MD5

      cb18333d0776b9993bf861d27753a87d

    • SHA1

      a4653ba5b59fe4937753f52084ec188ee6af1b0c

    • SHA256

      24a165d7c6ce42a827e515120c5253e3f8a0b085ed058283968444cec1c0d8de

    • SHA512

      7f4219f28d4297fa267314ca34f2bb4ee4a0ca36ffdadcb3cc83c41e4687e5c83e4f7fd2e22ba226598acb2048c655a89016b3446ab3854b8192f3f5ccdde528

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet Payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks