General
-
Target
4933185598291968.zip
-
Size
129KB
-
Sample
211122-klh2nsabb3
-
MD5
89be9f1a2a320fe1d33d74428a2cf9f8
-
SHA1
eef9615311899e866d1e973b449954ee0a887eee
-
SHA256
c01116d214a52721cad93ed79028da369ae699819b29e39154b7684b666dd225
-
SHA512
4ad44879007a84d0fba3e98bcfd4a930fcdd869f1c94793b8fd2c2abb5615fe6da157bdbd51f57209791cb32eeff2e826abd3b9240a0fd44b4000413fb702bee
Malware Config
Extracted
emotet
Epoch4
91.200.186.228:443
191.252.196.221:8080
94.177.248.64:443
66.42.55.5:7080
103.8.26.103:8080
185.184.25.237:8080
103.8.26.102:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
212.237.17.99:8080
212.237.56.116:7080
216.158.226.206:443
110.232.117.186:8080
Targets
-
-
Target
06012c700c1dac4c122303e920fdf1c71c41e681673c241c9698e5766df275a8
-
Size
140KB
-
MD5
391dca4cf91ae12aa1b5ac9d0ac3ec41
-
SHA1
47cfcf587d838f68a8f8df53ea3afae475436992
-
SHA256
06012c700c1dac4c122303e920fdf1c71c41e681673c241c9698e5766df275a8
-
SHA512
de299156048c8cb81fe9a5e839442347d118b9de47b353500647a73d4b97f010dcef6d6eb3c7ee9b04874010efd0b9f3b8790f8f9013a47271528eaed1be0c41
Score10/10-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Drops file in System32 directory
-