General

  • Target

    OwM.exe

  • Size

    352KB

  • Sample

    201118-76xzhmmraa

  • MD5

    6d1b5143db2fe11b313248fc9714408a

  • SHA1

    8a6e83834db5b15af90dcaaa9e27187a2834f068

  • SHA256

    9d67cfa82ab85d6579b976983b21d80237a08fb1d5400210e8072032858b7aba

  • SHA512

    61bf57a37e6ccf140d39714524af20b223a124ddb79b28ba6e434878fa2a412bda201de6d816e7e4c947b08aa74d1b6c17d736920eb9057fccb4927bbfdf96b8

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

152.32.75.74:443

91.121.200.35:8080

159.203.16.11:8080

188.226.165.170:8080

172.193.79.237:80

123.216.134.52:80

183.91.3.63:80

139.59.61.215:443

185.80.172.199:80

77.74.78.80:443

153.229.219.1:443

113.203.238.130:80

120.51.34.254:80

116.202.10.123:8080

5.2.246.108:80

50.116.78.109:8080

103.80.51.61:8080

190.55.186.229:80

185.142.236.163:443

223.17.215.76:80

rsa_pubkey.plain

Targets

    • Target

      OwM.exe

    • Size

      352KB

    • MD5

      6d1b5143db2fe11b313248fc9714408a

    • SHA1

      8a6e83834db5b15af90dcaaa9e27187a2834f068

    • SHA256

      9d67cfa82ab85d6579b976983b21d80237a08fb1d5400210e8072032858b7aba

    • SHA512

      61bf57a37e6ccf140d39714524af20b223a124ddb79b28ba6e434878fa2a412bda201de6d816e7e4c947b08aa74d1b6c17d736920eb9057fccb4927bbfdf96b8

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet Payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks