2019-09-16-Emotet-config

[+] Searching memory by Yara rules.
[+] Detect malware by Yara rules.
[+]   Process Name      : 393.exe
[+]   Process ID        : 2096
[+]   Malware name      : Emotet
[+]   Base Address(VAD) : 0x400000
[+]   Size              : 0x16000
----------------------------------------------------------------------
Process: 393.exe (2096)

[Config Info]
RSA Public Key        : -----BEGIN PUBLIC KEY-----
MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAM426uN11n2LZDk/JiS93WIWG7fGCQmP
4h5yIJUxJwrjwtGVexCelD2WKrDw9sa/xKwmQKk3b2fUhwnHXjoSpR7pLaDo7pEc
iJB5y6hjbPyrSfL3Fxu74M2SAS0Arj3uAQIDAQAB
-----END PUBLIC KEY-----
IP 0                  : 190.104.64.197:443
IP 1                  : 190.10.194.42:8080
IP 2                  : 190.171.105.158:7080
IP 3                  : 201.113.23.175:443
IP 4                  : 200.82.147.93:7080
IP 5                  : 93.78.205.196:443
IP 6                  : 176.58.93.123:8080
IP 7                  : 69.164.216.124:8080
IP 8                  : 190.13.146.47:443
IP 9                  : 139.59.242.76:8080
IP 10                 : 203.150.19.63:443
IP 11                 : 149.202.153.251:8080
IP 12                 : 190.55.39.215:80
IP 13                 : 181.230.126.152:8090
IP 14                 : 216.154.222.52:7080
IP 15                 : 5.9.128.163:8080
IP 16                 : 190.55.86.138:8443
IP 17                 : 159.69.211.211:7080
IP 18                 : 192.241.175.184:8080
IP 19                 : 190.92.103.7:80