Emotet 'C2 Servers' Entry Bundles 3 Unrelated IPs, No Shared Fingerprint

A "C2 Servers" Label That Can't Agree With Itself

A feed entry logged at 00:03 UTC on September 20 groups nine indicators under the category "c2-servers" — a single Emotet loader DLL and three IP addresses spread across Malaysia, Ghana and South Korea. The label implies a working command-and-control triangle behind a live banking-trojan campaign. The evidence inside the record says something closer to the opposite: none of the three IPs share an autonomous system, a certificate, or a registrant record with each other or with the file, and two of them are still serving TLS certificates that expired years — in one case a full decade — before anyone logged this observation. That gap between the label and the linkage is the story here, not the malware family, which is a routine and already well-documented one.

The file itself, an unsigned 422KB Win32 DLL carrying the hash beginning de16ea94…, is the only indicator in the set with anything substantive behind it — a sandbox verdict, a detection ratio, a rule hit. The other five hashes cataloged alongside it are empty rows: no file type, no size, no detection data, nothing to analyze. That asymmetry matters for how much weight the "campaign" framing can bear. CTX Team's read of the underlying evidence pack scores this record's cross-indicator confidence at 19 out of 100 — low by design, because a cohesive infrastructure cluster is exactly what the data cannot substantiate.

Three IPs, Three Continents, Zero Shared Fingerprint

Start with the geography, because it is the first thing that should give a threat hunter pause. 103.8.26.17 sits on AS132241, registered to SKSA Technology Sdn Bhd in Malaysia, a webhosting network out of Subang. 196.44.98.190 sits on AS327814, Ecoband Ltd, a Ghanaian dedicated-hosting block administered out of Accra. 116.124.128.206 sits on AS9318, SK Broadband, a South Korean consumer and business ISP. Three different regional registries — APNIC, AFRINIC, APNIC again but a wholly separate allocation — three different owners, three different countries, three different threat postures. Nothing in the certificate data, the WHOIS records, or the autonomous-system numbers ties any of these hosts to the other two. CTX Team's outlier pass independently flags each address as appearing on an ASN that shows up nowhere else in the set — a structural way of saying these are three isolated single-IP data points, not three nodes of one network.

That absence of concentration would be unremarkable on its own — plenty of malicious infrastructure is genuinely scattered — except that two of the three IPs carry a second, more specific anomaly: certificates that have no business being live. 103.8.26.17 is still presenting a self-signed TLS certificate issued to "Parallels, Inc." for the domain pva-iwh.com, with a validity window running from February 10, 2015 to February 10, 2016. That certificate has been expired for roughly a decade, and yet it is the certificate the server handed back when this record's snapshot was taken on September 20, 2026. A host serving a ten-year-dead cert under an unrelated brand name is not behaving like a freshly stood-up C2 endpoint; it reads like a webhosting box that was configured once, years ago, and never touched again — possibly compromised and repurposed, possibly just flagged in passing by a scanner that happened to hit port 443.

116.124.128.206 tells a quieter version of the same story. The last certificate observed on that host was issued by Sectigo RSA Domain Validation Secure Server CA to www.igogi.co.kr, valid from October 4, 2022 through October 4, 2023, and the observation date attached to it is October 10, 2022 — nearly four years removed from this record's September 2026 timeline. www.igogi.co.kr has no obvious connection to Emotet, to banking-trojan operations, or to anything else in this catalog; it looks like an entirely unrelated South Korean site that happened to be hosted on an SK Broadband address at some point. CTX Team reads this as more consistent with infrastructure reuse or a stale scan artifact than with an active control channel — an inference, not a confirmed fact, but one the certificate dates support directly. The third address, 196.44.98.190 in Ghana, carries no certificate data at all in this record and posts the lowest reputation score of the three, at -37, yet shares nothing structurally with its two peers either.

Braid those two observations together — the zero cross-indicator overlap on ASN and certificate serial, plus the multi-year-to-decade staleness on two of three certs — and the resulting judgment is straightforward: this is not a hosting cluster that was provisioned for one operation and cut over together, the pattern CTX Team looks for when infrastructure is genuinely coordinated. It is three addresses that got swept into the same feed entry because they co-occurred with a file submission, with no technical evidence that any of them is currently functioning as that file's control channel. Analysts pulling this record for blocklisting purposes should weigh that distinction carefully; treating 103.8.26.17 or 116.124.128.206 as confirmed live Emotet infrastructure on the strength of this record alone would be reading past what the data supports.

From inside a defended network, this distinction has a very specific practical shape. A SOC that ingests "c2-servers" feed entries wholesale and auto-generates firewall or proxy block rules from them would, on this record, end up blocking a South Korean broadband IP over a certificate that expired before most current employees joined the company, and a Malaysian webhost over a cert issued to a company that has nothing to do with the malware in question. Neither block is wrong, exactly — recycled or compromised infrastructure is still worth denying — but neither should be logged internally as "confirmed Emotet C2 contact" if it fires, because the record itself cannot support that label at the network layer.

The One File That Actually Talks

Strip away the IP layer and what remains is a single, better-evidenced object: the DLL. It is unsigned — signature validation was never attempted because there was no certificate to validate — and its import table is empty, a detail from the file's build record worth sitting with. A 64-bit Windows DLL with zero recorded imports is not how most legitimate code ships; it is consistent with a loader that resolves its API calls at runtime rather than declaring them statically, a packing or obfuscation choice [T1027] that trades a slightly heavier runtime footprint for a lighter static footprint. That is an inference from structural metadata rather than an observed unpacking trace, but it lines up with the threat label VirusTotal attaches to the file — trojan.emotet/clpz, with aliases including "fwdd" and popular-category tags of "trojan" and "banker" — and Emotet's long public history as a modular loader that leans on exactly this kind of import-obfuscation to slow static scanners down.

Detonation confirms the label rather than just repeating it. A single sandbox run returned a malicious verdict with 70% confidence and named the family directly: Emotet. That is thin sandbox coverage — one run, not a consensus across multiple engines — but the verdict is unambiguous, and it corresponds to the module actually executing as a DLL [T1129], the shared-modules technique that fits a loader component being invoked rather than run as a standalone binary. Detection sits at 32 of 75 security engines, with roughly 30 flagging the sample outright — names like APEX, Acronis, AhnLab-V3, Antiy-AVL, CrowdStrike, Microsoft and SentinelOne among them — while a dozen engines, including Alibaba, Kingsoft, VIPRE and ZoneAlarm, return nothing. That split is unremarkable for an Emotet loader variant; it is exactly the kind of partial-coverage pattern this family has produced for years across different vendor detection logics. One medium-severity Sigma rule, drawn from the broader Sigma Integrated Rule Set, also fires against the sample — a modest but real behavioral signature rather than a purely static one.

Cross two of those data points and a second judgment emerges: the file is well enough characterized that its family identity is not in serious doubt, but its provenance is. There is no delivery document, no dropper, no downstream payload observed anywhere in this record — publicly documented Emotet operations typically arrive through weaponized office documents that drop the loader as a follow-on stage, but nothing in this catalog captures that earlier hop. What CTX Team has here is the loader module in isolation, submitted once, on September 18, 2026, two days before this record's snapshot — a fresh submission on an old, well-understood family, disconnected from whatever delivery chain put it in front of a victim.

A Loader Without a Confirmed Home

The natural next question is where this loader phones home, and this is where the chain runs out of solid ground. Emotet as a family is broadly associated with HTTP-based command-and-control [T1071] for pulling down configuration updates and additional modules, and that is presumably what this sample is built to do. But that association is a statement about the family in general, not a demonstrated link to any specific address in this record. None of the three cataloged IPs shares a certificate, an ASN, or a resolution path with the file; the cohort-linkage data for every one of the nine indicators in this entry comes back empty. So the C2 stage of this attack chain is being asserted at the level of "this is what Emotet usually does," not "this is what this file was observed doing" — a distinction CTX Team's own tradecraft read is explicit about, and one worth keeping visible rather than letting it dissolve into the confidence of the surrounding prose.

That gap is itself informative about how this kind of low-signal record should be used. A loader with a confirmed detonation but no confirmed C2 endpoint is a real artifact worth tracking on its own detection merits — the 32/75 ratio, the Sigma hit, the sandbox-named family are all facts an analyst can act on directly. But bolting three geographically arbitrary IPs onto it under a shared category tag does not upgrade the confidence of the infrastructure claim; it just widens the blast radius of what gets treated as "part of the campaign" without adding evidence that any of it actually is.

Financially Motivated, Thinly Attributed

Nothing in this record names an actor, and none should be inferred here beyond what the malware label itself supports. The "banker" and "trojan" category tags, paired with the Emotet family classification, place this firmly inside the financially-motivated loader ecosystem that has operated at scale for years rather than pointing toward any state-aligned tooling — but that reading comes from the malware label alone, not from any actor or campaign attribution present in the underlying record. No historical arc, prior named operation, or attributed group ties into this specific file or infrastructure set, and inventing one to fill that gap would overstate what nine loosely bundled indicators actually establish.

What a Low-Confidence Cluster Still Teaches

The lesson this record offers is less about Emotet — a family whose loader tradecraft is by now thoroughly cataloged across the industry — and more about how "campaign" framing can outrun its own evidence inside an automated feed. A single well-profiled loader (32/75 detections, a sandbox-confirmed Emotet verdict, a zero-import build) sitting next to three unrelated IPs, two of them serving certificates that predate the observation by years to a decade, is not a cohesive infrastructure story. It is a coincidence of cataloging that happens to carry a "c2-servers" tag and a severity score of 100, numbers that describe the file's danger, not the infrastructure's cohesion. The retail-sector, United States tagging attached to this record likewise reflects a classification label rather than any observed delivery chain into a specific victim environment, and should be read with the same caution.

What this does signal for the broader threat landscape is a maintenance problem as much as a technical one: as feeds scale and automated enrichment pulls in every IP that co-occurs with a hash submission, the ratio of genuinely linked infrastructure to incidentally bundled infrastructure will keep drifting downward unless staleness signals — certificate age chief among them — get weighted into confidence scoring rather than left for an analyst to notice by hand. A decade-old "Parallels, Inc." certificate still answering on port 443 in 2026 is a small, almost trivial data point. But it is exactly the kind of detail that separates a live control channel from a recycled server that happened to be scanned at the wrong moment, and on this record, it is the detail that keeps the "C2" label from being taken at face value.