General

  • Target

    emotet_exe_e3_03fa0d0499b3d684eb875bb4b61365575a1b6834e4bff26ea9c2e544149eca85_2020-11-17__175437.exe

  • Size

    490KB

  • Sample

    201117-sdj5v13sd2

  • MD5

    4c45a0776d07a6c75be6b797d3c059bd

  • SHA1

    5e2b00dac7d3abd4dbc9b753b3c45c932ecf5a55

  • SHA256

    03fa0d0499b3d684eb875bb4b61365575a1b6834e4bff26ea9c2e544149eca85

  • SHA512

    b2feadc7c21379b4d51a1625500224ddbd2a7673c2558ba445d93f1e685376b745295659ad3ca3781520f00eabf657183df099237cdd62f0fa4d3451fc9001f7

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

85.246.78.192:80

188.226.165.170:8080

188.40.170.197:80

51.38.50.144:8080

175.103.38.146:80

192.210.217.94:8080

180.23.53.200:80

202.29.237.113:8080

58.27.215.3:8080

190.85.46.52:7080

36.91.44.183:80

190.164.135.81:80

37.205.9.252:7080

192.241.220.183:8080

5.2.246.108:80

180.21.3.52:80

85.75.49.113:80

190.55.186.229:80

116.91.240.96:80

180.148.4.130:8080

rsa_pubkey.plain

Targets

    • Target

      emotet_exe_e3_03fa0d0499b3d684eb875bb4b61365575a1b6834e4bff26ea9c2e544149eca85_2020-11-17__175437.exe

    • Size

      490KB

    • MD5

      4c45a0776d07a6c75be6b797d3c059bd

    • SHA1

      5e2b00dac7d3abd4dbc9b753b3c45c932ecf5a55

    • SHA256

      03fa0d0499b3d684eb875bb4b61365575a1b6834e4bff26ea9c2e544149eca85

    • SHA512

      b2feadc7c21379b4d51a1625500224ddbd2a7673c2558ba445d93f1e685376b745295659ad3ca3781520f00eabf657183df099237cdd62f0fa4d3451fc9001f7

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet Payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks