General
-
Target
emotet_e2_7aa2b2705bbf9bb3f223259b9868c36756743492d88351984e1bda682b94a37e_2021-01-04__205304451894._doc
-
Size
162KB
-
Sample
210104-ypkaw5zann
-
MD5
ec95ab38cfdbb3fd11cbbf6ed187d1a2
-
SHA1
93810fc3bb81fbf72d6b7e5411be33d2c351e549
-
SHA256
7aa2b2705bbf9bb3f223259b9868c36756743492d88351984e1bda682b94a37e
-
SHA512
111a28bd7428466a8551ff44cc9f4f889f089a725f75c25036efba42a90a66d821475b10898583e38323b9170757b45fcac10a40b4d75f1d16ab629a676e1ab3
Malware Config
Extracted
https://admintk.com/wp-admin/L/
https://mikegeerinck.com/c/YYsa/
http://freelancerwebdesignerhyderabad.com/cgi-bin/S/
http://etdog.com/wp-content/nu/
https://www.hintup.com.br/wp-content/dE/
http://www.stmarouns.nsw.edu.au/paypal/b8G/
http://wm.mcdevelop.net/content/6F2gd/
Extracted
emotet
Epoch2
90.160.138.175:80
74.222.117.42:80
157.245.123.197:8080
50.116.111.59:8080
173.249.20.233:443
200.116.145.225:443
142.112.10.95:20
87.106.139.101:8080
173.70.61.180:80
75.177.207.146:80
121.124.124.40:7080
98.109.133.80:80
37.187.72.193:8080
74.40.205.197:443
220.245.198.194:80
197.211.245.21:80
123.176.25.234:80
194.190.67.75:80
78.188.225.105:80
217.20.166.178:7080
Targets
-
-
Target
emotet_e2_7aa2b2705bbf9bb3f223259b9868c36756743492d88351984e1bda682b94a37e_2021-01-04__205304451894._doc
-
Size
162KB
-
MD5
ec95ab38cfdbb3fd11cbbf6ed187d1a2
-
SHA1
93810fc3bb81fbf72d6b7e5411be33d2c351e549
-
SHA256
7aa2b2705bbf9bb3f223259b9868c36756743492d88351984e1bda682b94a37e
-
SHA512
111a28bd7428466a8551ff44cc9f4f889f089a725f75c25036efba42a90a66d821475b10898583e38323b9170757b45fcac10a40b4d75f1d16ab629a676e1ab3
Score10/10-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Loads dropped DLL
-
Drops file in System32 directory
-