General
-
Target
5139816365457408.zip
-
Size
361KB
-
Sample
210329-z6hwt8mfq6
-
MD5
f016f5658e4aba3da944420bd87dc7c6
-
SHA1
15d0ef58c1f1f5fc0342b8630349d37ce9ca7f36
-
SHA256
9b6a6dbf1c6c44e80d04fabdac75b451f704a2eaa15768075d2e409c62d92330
-
SHA512
0d683a83a983b453b69d2586ef656a4c7d1a6cd3ef15d41411fefde51c8a6d5a8cccd40395c81246098e142db89854acc758f24d33a9affd8188a0c34a03a35e
Malware Config
Extracted
emotet
Epoch3
190.55.186.229:80
203.157.152.9:7080
157.245.145.87:443
132.248.38.158:80
110.172.180.180:8080
70.32.89.105:8080
161.49.84.2:80
37.46.129.215:8080
50.116.78.109:8080
115.79.195.246:80
178.62.254.156:8080
175.103.38.146:80
188.226.165.170:8080
91.93.3.85:8080
162.144.145.58:8080
117.2.139.117:443
190.85.46.52:7080
201.193.160.196:80
152.32.75.74:443
195.201.56.70:8080
Extracted
emotet
LEA
80.158.3.161:443
80.158.51.209:8080
80.158.35.51:80
80.158.63.78:443
80.158.53.167:80
80.158.62.194:443
80.158.59.174:8080
80.158.43.136:80
Targets
-
-
Target
8fe3fde9e0a98332e4a8b7b65eadd1745c8e1c29b1bfd5974bd018d255e139e9
-
Size
609KB
-
MD5
015c80d341a3aebc2b30d6ed28a663b5
-
SHA1
26b8e9a1ad9b66bc0944f01ace690046f829ad32
-
SHA256
8fe3fde9e0a98332e4a8b7b65eadd1745c8e1c29b1bfd5974bd018d255e139e9
-
SHA512
43ba89dc4b7392474b814536ae604040568f2bd15fb1cbf3de29c2aad489f835a2ab7d21ef7975cf036ba997d5de8eeda1540b078e59ca6de4ddb1a0e4798b78
Score10/10-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Blocklisted process makes network request
-
Deletes itself
-
Loads dropped DLL
-
Drops file in System32 directory
-