General

  • Target

    SecuriteInfo.com.Trojan.DownLoader34.9370.14996.32145

  • Size

    612KB

  • Sample

    200801-shjzvvan3s

  • MD5

    d1205a22f154aead1a88475f099e407c

  • SHA1

    2e9aa1c7fb10fed9b1ead06a3ab40a5809214764

  • SHA256

    4c9315aa6429d9626031c59b3399298b6a1dc891f526290319887bfbd0103a41

  • SHA512

    2c5a9b1df07f3c56eb30f1c12bdf9909d21c440e4ca2712bfb670289982f5607eb7ac0444e2fb0844b6bd14919f94dcc8a41c692c48cb12f8cdf7fb946c6b002

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

179.60.229.168:443

185.94.252.13:443

189.218.165.63:80

77.90.136.129:8080

217.199.160.224:7080

104.131.41.185:8080

2.47.112.152:80

185.94.252.27:443

186.250.52.226:8080

51.255.165.160:8080

68.183.170.114:8080

191.99.160.58:80

104.131.103.37:8080

181.31.211.181:80

202.62.39.111:80

83.169.21.32:7080

87.106.46.107:8080

72.47.248.48:7080

177.75.143.112:443

190.17.195.202:80

rsa_pubkey.plain

Targets

    • Target

      SecuriteInfo.com.Trojan.DownLoader34.9370.14996.32145

    • Size

      612KB

    • MD5

      d1205a22f154aead1a88475f099e407c

    • SHA1

      2e9aa1c7fb10fed9b1ead06a3ab40a5809214764

    • SHA256

      4c9315aa6429d9626031c59b3399298b6a1dc891f526290319887bfbd0103a41

    • SHA512

      2c5a9b1df07f3c56eb30f1c12bdf9909d21c440e4ca2712bfb670289982f5607eb7ac0444e2fb0844b6bd14919f94dcc8a41c692c48cb12f8cdf7fb946c6b002

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet Payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks