Emotet C2 and RSA Key - Update 04/28/2020 at 23:59 UTC
News: Still no Emotet back this week for spamming but once again more shennanigans with Trickbot installs doing option 42 to drop Emotet E2 as shown by Fate112 in his post here: https://twitter.com/tosscoinwitcher/status/1255259004164542464
Watch for the falling C2 combos… seems like they are doing a lot of spring cleaning as counts plummet as of late.
Key and current C2 list below for each Epoch:
C2’s Per Epoch
Epoch 1 C2s
181.10.204.106:80
91.236.4.234:443
172.104.169.32:8080
94.176.234.118:443
114.109.179.60:80
68.183.190.199:8080
91.83.93.124:7080
143.0.87.101:80
12.162.84.2:8080
185.94.252.12:80
2.47.112.152:80
190.57.130.142:443
177.139.131.143:443
186.68.48.204:443
203.122.18.234:8080
200.69.224.73:80
164.77.130.222:80
178.79.163.131:8080
212.71.237.140:8080
202.62.39.111:80
188.129.197.149:80
177.103.159.44:80
65.24.85.214:80
177.72.13.80:80
104.131.41.185:8080
221.133.46.86:443
190.229.148.144:80
49.176.162.90:80
187.162.248.237:80
186.3.232.68:80
77.55.211.77:8080
104.236.161.64:8080
185.94.252.13:443
50.28.51.143:8080
82.196.15.205:8080
170.81.48.2:80
190.181.235.46:80
47.150.248.161:80
77.90.136.129:8080
186.33.141.88:80
201.91.28.210:80
104.131.103.37:8080
192.241.143.52:8080
212.156.219.6:8080
190.17.195.202:80
181.30.69.50:80
93.147.157.195:80
93.147.137.162:80
177.73.3.204:80
152.170.222.65:80
111.67.12.221:8080
45.161.242.102:80
118.69.71.14:80
177.66.190.130:80
70.32.115.157:8080
113.161.147.51:80
46.28.111.142:7080
72.47.248.48:7080
113.190.254.245:80
181.164.215.193:80
83.169.21.32:7080
70.32.84.74:8080
82.240.207.95:443
149.62.173.247:8080
203.25.159.3:8080
185.94.252.27:443
152.231.89.226:80
177.38.15.151:80
189.1.185.248:80
204.225.249.100:7080
192.241.146.84:8080
179.62.26.236:80
37.187.6.63:8080
200.126.237.113:80
175.114.178.83:443
5.196.35.138:7080
177.188.121.26:443
73.239.11.159:80
46.214.11.172:80
181.31.211.181:80
201.213.32.59:80
151.237.36.220:80
110.143.8.89:80
61.92.159.208:8080
187.51.47.26:80
59.120.5.154:80
Epoch 1 C2 Changes
Count: 86
Dropped:
A bunch
Added:
NIL
Current Epoch 1 RSA Public Key
MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAOZ9fLJ8UrI0OZURpPsR3eijAyfPj3z6
uS75f2igmYFW2aWgNcFIzsAYQleKzD0nlCFHOo7Zf8/4wY2UW0CJ4dJEHnE/PHlz
6uNk3pxjm7o4eCDyiJbzf+k0Azjl0q54FQIDAQAB
Epoch 2 C2s
185.155.20.82:80
82.223.70.24:8080
58.171.38.26:80
103.86.49.11:8080
31.31.77.83:443
92.222.216.44:8080
186.208.123.210:443
136.243.205.112:7080
60.130.173.117:80
160.16.215.66:8080
98.15.140.226:80
162.241.92.219:8080
78.186.5.109:443
87.127.197.7:8080
168.235.67.138:7080
210.56.10.58:80
60.250.78.22:443
114.145.241.208:80
104.131.11.150:443
62.75.141.82:80
193.80.169.64:80
139.130.242.43:80
87.106.139.101:8080
23.92.16.164:8080
177.230.81.0:22
41.60.200.34:80
211.63.71.72:8080
212.174.19.87:80
113.160.130.116:8443
67.235.68.222:80
62.138.26.28:8080
45.33.49.124:443
104.131.44.150:8080
120.151.135.224:80
74.208.45.104:8080
95.128.43.213:8080
37.187.72.193:8080
185.94.252.104:443
176.9.43.37:8080
78.24.219.147:8080
46.105.131.69:443
98.156.206.153:80
101.187.97.173:80
176.111.60.55:8080
46.105.131.87:80
110.145.77.103:80
37.139.21.175:8080
201.173.217.124:443
190.108.228.62:8080
62.75.187.192:8080
24.194.252.25:80
87.106.136.232:8080
95.213.236.64:8080
200.41.121.90:80
24.94.237.248:80
5.196.74.210:8080
58.177.172.160:80
5.39.91.110:7080
68.44.137.144:443
91.205.215.66:443
59.20.65.102:80
190.160.53.126:80
209.141.54.221:8080
70.48.238.90:80
195.244.215.206:80
169.239.182.217:8080
209.151.248.242:8080
178.20.74.212:80
104.236.246.93:8080
50.116.86.205:8080
93.51.50.171:8080
113.61.66.94:80
Epoch 2 C2 Changes
Count: 72
Dropped:
A bunch
Added:
NIL
Current Epoch 2 RSA Public Key
MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhANQOcBKvh5xEW7VcJ9totsjdBwuAclxS
Q0e09fk8V053lktpW3TRrzAW63yt6j1KWnyxMrU3igFXypBoI4lVNmkje4UPtIIS
fkzjEIvG1v/ZNn1k0J0PfFTxbFFeUEs3AwIDAQAB
Epoch 3 C2s
177.144.130.105:443
124.150.175.133:8080
163.172.107.70:8080
122.116.104.238:8080
201.214.229.79:80
113.161.148.81:80
172.104.70.207:8080
186.80.169.128:80
51.38.134.203:8080
139.59.12.63:8080
95.180.25.146:80
186.10.92.114:80
117.2.133.44:443
78.188.170.128:80
14.161.6.60:80
177.0.241.28:80
46.17.6.116:8080
109.236.109.159:8080
72.10.33.195:8080
211.20.154.102:443
157.7.164.178:8081
181.225.24.251:80
102.22.62.71:80
220.132.16.114:80
37.70.131.107:80
80.211.32.88:8080
185.142.236.163:443
82.146.55.23:7080
190.251.235.239:80
60.53.197.6:80
50.116.78.109:8080
195.201.56.70:8080
220.128.125.18:80
192.210.217.94:8080
37.208.106.146:8080
45.118.136.92:8080
188.0.135.237:80
91.83.93.103:443
81.215.14.128:80
113.160.180.109:80
46.32.229.152:8080
192.163.221.191:8080
75.127.14.170:8080
77.74.78.80:443
82.165.15.188:8080
192.241.220.183:8080
190.171.153.139:80
41.185.29.128:8080
37.46.129.215:8080
203.153.216.178:7080
31.146.61.34:80
217.12.70.226:80
203.153.216.182:7080
115.79.195.246:80
42.51.192.231:8080
50.63.13.135:8080
Epoch 3 C2 Changes
Count: 56
Dropped:
A bunch
Added:
NIL
Current Epoch 3 RSA Public Key
MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAM/TXLLvX91I6dVMYe+T1PPO6mpcg7OJ
cMl9o/g4nUhZOp8fAAmQl8XMXeGvDhZXTyX1AXf401iPFui0RB6glhl/7/djvi7j
l32lAhyBANpKGty8xf3J5kGwwClnG/CXHQIDAQAB
Sandbox
E1
CAPE DOWN
E2
CAPE DOWN
E3
CAPE DOWN
-@Cryptolaemus1 Team