emotet

General

Target

414-41121
Size

70KB
Sample

220120-sk5s2sadg5
MD5

d359ceae9e4508f14e87dc75a1c3b78b
SHA1

983ca9387eec8f5d52546fa946287de326817dd4
SHA256

65d3abc5b6aa3d3b137bc8050638e3bfd3460135160daaef97332652e17f1415
SHA512

dcf66bdc6009bd87977118a31ae2d85d05e6d058717ca20d7d7193d5f8c538e92d9257f875a8a6c877061ef0c9e0f16359c4b67feb5f22760fa0988e97984bd6

Score

10^/10

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://0x5cff39c3/sec/se1.html

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://92.255.57.195/sec/se1.png

Extracted

Family

emotet

Botnet

Epoch5

C2

45.138.98.34:80

69.16.218.101:8080

51.210.242.234:8080

185.148.168.220:8080

142.4.219.173:8080

54.38.242.185:443

191.252.103.16:80

104.131.62.48:8080

62.171.178.147:8080

217.182.143.207:443

168.197.250.14:80

37.44.244.177:8080

66.42.57.149:443

210.57.209.142:8080

159.69.237.188:443

116.124.128.206:8080

128.199.192.135:8080

195.154.146.35:443

185.148.168.15:8080

195.77.239.39:8080

eck1.plain

ecs1.plain

Targets

- Target
  
  414-41121
- Size
  
  70KB
- MD5
  
  d359ceae9e4508f14e87dc75a1c3b78b
- SHA1
  
  983ca9387eec8f5d52546fa946287de326817dd4
- SHA256
  
  65d3abc5b6aa3d3b137bc8050638e3bfd3460135160daaef97332652e17f1415
- SHA512
  
  dcf66bdc6009bd87977118a31ae2d85d05e6d058717ca20d7d7193d5f8c538e92d9257f875a8a6c877061ef0c9e0f16359c4b67feb5f22760fa0988e97984bd6
Score

10^/10

emotet epoch5 banker macro trojan xlm
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request
- Downloads MZ/PE file
- Suspicious Office macro
  Office document equipped with 4.0 macros.
  macro xlm
- Loads dropped DLL
- Drops file in System32 directory
behavioral1