emotet

General

Target

85d095862eac57f9468543eca0c155a633dcbe0258599cb769b157125686fd88.doc
Size

169KB
Sample

200729-rp4etywccs
MD5

0df9210729b8327d60535a0814fc8537
SHA1

df7891518edacf404b9b97f26765fdfd275a8d2b
SHA256

85d095862eac57f9468543eca0c155a633dcbe0258599cb769b157125686fd88
SHA512

70fb89116084a4e03ef2d0f915928f63f39b6e604fff0a3744285258d884d5c819b1612598e1ced93b2eb89cb086010eeb81e96f3c16e46f326759b05d95e36e

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://jojofun.co.uk/loges/v7yi_9z9l1_evrg/

exe.dropper

http://macserwis.pl/4995371c/1_m_1dau4ki6f/

exe.dropper

http://kennol.pk/wp-admin/yu7d_oh2g_zmwbfmqo/

exe.dropper

http://lf-hj.cz/a_b3rvy_ua/

exe.dropper

http://www.marisqueiraobarqueiro.pt/modules/2eyu_76wd_82/

Extracted

Family

emotet

Botnet

Epoch2

C2

76.27.179.47:80

212.51.142.238:8080

189.212.199.126:443

61.19.246.238:443

162.154.38.103:80

91.211.88.52:7080

83.110.223.58:443

124.45.106.173:443

116.203.32.252:8080

109.117.53.230:443

5.196.74.210:8080

75.139.38.211:80

168.235.67.138:7080

176.111.60.55:8080

169.239.182.217:8080

74.208.45.104:8080

31.31.77.83:443

222.214.218.37:4143

37.139.21.175:8080

91.205.215.66:443

rsa_pubkey.plain

Targets

- Target
  
  85d095862eac57f9468543eca0c155a633dcbe0258599cb769b157125686fd88.doc
- Size
  
  169KB
- MD5
  
  0df9210729b8327d60535a0814fc8537
- SHA1
  
  df7891518edacf404b9b97f26765fdfd275a8d2b
- SHA256
  
  85d095862eac57f9468543eca0c155a633dcbe0258599cb769b157125686fd88
- SHA512
  
  70fb89116084a4e03ef2d0f915928f63f39b6e604fff0a3744285258d884d5c819b1612598e1ced93b2eb89cb086010eeb81e96f3c16e46f326759b05d95e36e
Score

10^/10

trojan banker emotet
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Emotet Payload
  Detects Emotet payload in memory.
- Blacklisted process makes network request
- Executes dropped EXE
- Drops file in System32 directory
behavioral1