emotet

General

Target

fcad2a97c97b92310e8c88ae7aa71452923bc3c8e67d4be4d12b5b93320432ae.doc
Size

168KB
Sample

200731-5zm9ax6sgj
MD5

19d28177f751a82727b953ead1233de1
SHA1

3e0d77ed9978c582ad1b3bdb5aa1213638b27abe
SHA256

fcad2a97c97b92310e8c88ae7aa71452923bc3c8e67d4be4d12b5b93320432ae
SHA512

1951217d0e1d967f1e77f0145c3a08cbbf483298e79f2ee8b6b6a4db2d18d208bd4e7b84d08c7e541a1a49fbfb3cc881991cbd9e1cf23803ddb865d0bef4acaf

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://artexproductions.com/cgi-bin/xHdbmk/

exe.dropper

http://whistledownfarm.com/cgi-bin/tlsjw81/

exe.dropper

http://e-motiva.com/wp-admin/bFr531220/

exe.dropper

http://stolkie.net/m/H0LV59574/

exe.dropper

http://www.faccomputer.com/images/5mMAg7bKKK/

Extracted

Family

emotet

Botnet

Epoch1

C2

73.116.193.136:80

185.94.252.13:443

149.62.173.247:8080

89.32.150.160:8080

185.94.252.12:80

77.90.136.129:8080

83.169.21.32:7080

104.236.161.64:8080

114.109.179.60:80

189.2.177.210:443

68.183.190.199:8080

144.139.91.187:443

185.94.252.27:443

190.181.235.46:80

82.196.15.205:8080

46.28.111.142:7080

181.167.96.215:80

202.62.39.111:80

219.92.13.25:80

191.99.160.58:80

rsa_pubkey.plain

Targets

- Target
  
  fcad2a97c97b92310e8c88ae7aa71452923bc3c8e67d4be4d12b5b93320432ae.doc
- Size
  
  168KB
- MD5
  
  19d28177f751a82727b953ead1233de1
- SHA1
  
  3e0d77ed9978c582ad1b3bdb5aa1213638b27abe
- SHA256
  
  fcad2a97c97b92310e8c88ae7aa71452923bc3c8e67d4be4d12b5b93320432ae
- SHA512
  
  1951217d0e1d967f1e77f0145c3a08cbbf483298e79f2ee8b6b6a4db2d18d208bd4e7b84d08c7e541a1a49fbfb3cc881991cbd9e1cf23803ddb865d0bef4acaf
Score

10^/10

trojan banker emotet
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Emotet Payload
  Detects Emotet payload in memory.
- Blacklisted process makes network request
- Executes dropped EXE
- Drops file in System32 directory
behavioral1