General
-
Target
6cfd86adfe720a6432fb65748f6d9c8607f6c15fe412f73e1efd964268152bba
-
Size
126KB
-
Sample
220328-3absbscfck
-
MD5
740c2fd49ffd35f90ee0b03d1040a28a
-
SHA1
796e34c55a27ee8807b64a5a8063c378fade6662
-
SHA256
6cfd86adfe720a6432fb65748f6d9c8607f6c15fe412f73e1efd964268152bba
-
SHA512
e5dadbcdfdac2b3bd04979f5ed71bf71bb6c5497b90b0906dac59b952e3ec2df864e52e0976a281805fe5a23319ee1288e0ea46fe88574005e6c4d8920592325
Malware Config
Extracted
http://med.devsrm.com/wp-content/gtOOTHi3zkUbn8U6/
http://izytalab.com/includes/1mafAX0kOa/
https://pcsolutionss.com/zSlT4HR92TiOpw5NM/
http://www.doctorcasenave.com/wp-content/O2Z1HMebIXiHYBBS/
https://wpl28.realtyna.com/wp-content/0b0ny5cPM/
http://www.efcballjoint.com/Template/AxEZPOfAa9/
Extracted
http://med.devsrm.com/wp-content/gtOOTHi3zkUbn8U6/
Extracted
emotet
Epoch4
216.120.236.62:8080
189.232.46.161:443
51.91.76.89:8080
217.182.25.250:8080
119.193.124.41:7080
159.8.59.82:8080
195.201.151.129:8080
58.227.42.236:80
212.24.98.99:8080
138.185.72.26:8080
131.100.24.231:80
192.99.251.50:443
158.69.222.101:443
197.242.150.244:8080
50.116.54.215:443
188.44.20.25:443
212.237.17.99:8080
153.126.146.25:7080
103.75.201.2:443
5.9.116.246:8080
Targets
-
-
Target
6cfd86adfe720a6432fb65748f6d9c8607f6c15fe412f73e1efd964268152bba
-
Size
126KB
-
MD5
740c2fd49ffd35f90ee0b03d1040a28a
-
SHA1
796e34c55a27ee8807b64a5a8063c378fade6662
-
SHA256
6cfd86adfe720a6432fb65748f6d9c8607f6c15fe412f73e1efd964268152bba
-
SHA512
e5dadbcdfdac2b3bd04979f5ed71bf71bb6c5497b90b0906dac59b952e3ec2df864e52e0976a281805fe5a23319ee1288e0ea46fe88574005e6c4d8920592325
Score10/10-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Drops file in System32 directory
-