General
-
Target
emotet_e2_9e894e36a4b04050aa1f3f12c19607fecdd5af0a1af362c033e1c5ed55229896_2020-09-24__065618796088._doc
-
Size
152KB
-
Sample
200924-4p7a5jsrdj
-
MD5
9eabe89a43f250e2735dc5e3b2d168cf
-
SHA1
a54b77bc4855eb0e1d940a2432065d95161ed2a9
-
SHA256
9e894e36a4b04050aa1f3f12c19607fecdd5af0a1af362c033e1c5ed55229896
-
SHA512
c68281754c4da9897e36d3b47128e921192c9cbf382ea000e9b3ab0a952a4f6560f001f726e85924837917b642594d738d52794ecd9f1766f0e9c27d19874692
Malware Config
Extracted
http://www.firhajshoes.com/wp-admin/RgaiT/
http://fakeread.com/OneSignal-Web-SDK-HTTPS-Integration-Files/Wf/
http://www.rttutoring.com/wp-includes/LlbY6o/
http://blueskysol.com/sys-cache/2Rk/
http://crazyboxs.com/cgi-bin/IaJ/
http://www.paramedicaleducationguidelines.com/wp-admin/3jXU5Bp/
http://nuhatoys.com/wp-admin/WWA4R/
Extracted
emotet
Epoch2
174.106.122.139:80
159.203.116.47:8080
173.249.6.108:443
104.236.246.93:8080
174.45.13.118:80
137.59.187.107:8080
94.200.114.161:80
37.187.72.193:8080
67.10.155.92:80
121.124.124.40:7080
24.43.99.75:80
75.139.38.211:80
109.74.5.95:8080
137.119.36.33:80
74.134.41.124:80
66.65.136.14:80
94.1.108.190:443
181.169.235.7:80
79.137.83.50:443
104.131.44.150:8080
Targets
-
-
Target
emotet_e2_9e894e36a4b04050aa1f3f12c19607fecdd5af0a1af362c033e1c5ed55229896_2020-09-24__065618796088._doc
-
Size
152KB
-
MD5
9eabe89a43f250e2735dc5e3b2d168cf
-
SHA1
a54b77bc4855eb0e1d940a2432065d95161ed2a9
-
SHA256
9e894e36a4b04050aa1f3f12c19607fecdd5af0a1af362c033e1c5ed55229896
-
SHA512
c68281754c4da9897e36d3b47128e921192c9cbf382ea000e9b3ab0a952a4f6560f001f726e85924837917b642594d738d52794ecd9f1766f0e9c27d19874692
Score10/10-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Emotet Payload
Detects Emotet payload in memory.
-
Blacklisted process makes network request
-
Executes dropped EXE
-
Drops file in System32 directory
-