emotet

General

Target

c5ecaf6cd3bbdfa50593e98e47cf4a5efea793dc5112f0b09fcfcd77f16daf7a.doc
Size

168KB
Sample

200731-7lm8cy6pt2
MD5

0d9be35895654df690a175e2a6c8199e
SHA1

41c76d651005c7e809c7709a535ffca47a12c2e4
SHA256

c5ecaf6cd3bbdfa50593e98e47cf4a5efea793dc5112f0b09fcfcd77f16daf7a
SHA512

bd160c80b42fbddde8cf5fc9e039e5a26ba1299b6975ffc3d4b4f30ce289d88786f9ffcf043f6ed4b4efa6fe8805c9f1675a400d46429ceae580a38ccbeb37b0

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://artexproductions.com/cgi-bin/xHdbmk/

exe.dropper

http://whistledownfarm.com/cgi-bin/tlsjw81/

exe.dropper

http://e-motiva.com/wp-admin/bFr531220/

exe.dropper

http://stolkie.net/m/H0LV59574/

exe.dropper

http://www.faccomputer.com/images/5mMAg7bKKK/

Extracted

Family

emotet

Botnet

Epoch1

C2

73.116.193.136:80

185.94.252.13:443

149.62.173.247:8080

89.32.150.160:8080

185.94.252.12:80

77.90.136.129:8080

83.169.21.32:7080

104.236.161.64:8080

114.109.179.60:80

189.2.177.210:443

68.183.190.199:8080

144.139.91.187:443

185.94.252.27:443

190.181.235.46:80

82.196.15.205:8080

46.28.111.142:7080

181.167.96.215:80

202.62.39.111:80

219.92.13.25:80

191.99.160.58:80

rsa_pubkey.plain

Targets

- Target
  
  c5ecaf6cd3bbdfa50593e98e47cf4a5efea793dc5112f0b09fcfcd77f16daf7a.doc
- Size
  
  168KB
- MD5
  
  0d9be35895654df690a175e2a6c8199e
- SHA1
  
  41c76d651005c7e809c7709a535ffca47a12c2e4
- SHA256
  
  c5ecaf6cd3bbdfa50593e98e47cf4a5efea793dc5112f0b09fcfcd77f16daf7a
- SHA512
  
  bd160c80b42fbddde8cf5fc9e039e5a26ba1299b6975ffc3d4b4f30ce289d88786f9ffcf043f6ed4b4efa6fe8805c9f1675a400d46429ceae580a38ccbeb37b0
Score

10^/10

trojan banker emotet
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Emotet Payload
  Detects Emotet payload in memory.
- Blacklisted process makes network request
- Executes dropped EXE
- Drops file in System32 directory
behavioral1