General
-
Target
62aa0bc0617f8f40908642b1e9b933ef99c9b9a46e7fd061ad689eff28a438fa
-
Size
106KB
-
Sample
220329-zw8seafder
-
MD5
db64d5b887a8228c75b3b7bdadc0245e
-
SHA1
38f8f6163b8620f23e380faed62f8fe39521da13
-
SHA256
62aa0bc0617f8f40908642b1e9b933ef99c9b9a46e7fd061ad689eff28a438fa
-
SHA512
5ae443ee355b785e19dd5cd8695d9523e02080fdb36b8a465e56a8e667f081fd44a888d579597ea573e4d8dedd747df3d1943e2f150f01e81939bba0ba3117a8
Malware Config
Extracted
http://dougveeder.com/cgi-bin/xJ91ZttGRioQ7IUL/
https://e-fistik.com/ajax/PnA23/
http://dsinformaticos.com/_private/f36Yl/
http://dstny.net/cgi-bin/POqJKcxiIzRb/
http://fakecity.net/cache/XtIzhyLEoLI7/
http://fayeschmidt.com/cgi-bin/Q8pj6/
Extracted
http://dougveeder.com/cgi-bin/xJ91ZttGRioQ7IUL/
https://e-fistik.com/ajax/PnA23/
Extracted
emotet
Epoch4
45.176.232.125:443
138.197.109.175:8080
187.84.80.182:443
79.143.187.147:443
189.232.46.161:443
103.70.28.102:8080
134.122.66.193:8080
151.106.112.196:8080
160.16.142.56:8080
212.24.98.99:8080
188.44.20.25:443
197.242.150.244:8080
206.189.28.199:8080
172.104.251.154:8080
103.43.46.182:443
203.114.109.124:443
103.75.201.2:443
58.227.42.236:80
201.94.166.162:443
189.126.111.200:7080
Targets
-
-
Target
62aa0bc0617f8f40908642b1e9b933ef99c9b9a46e7fd061ad689eff28a438fa
-
Size
106KB
-
MD5
db64d5b887a8228c75b3b7bdadc0245e
-
SHA1
38f8f6163b8620f23e380faed62f8fe39521da13
-
SHA256
62aa0bc0617f8f40908642b1e9b933ef99c9b9a46e7fd061ad689eff28a438fa
-
SHA512
5ae443ee355b785e19dd5cd8695d9523e02080fdb36b8a465e56a8e667f081fd44a888d579597ea573e4d8dedd747df3d1943e2f150f01e81939bba0ba3117a8
Score10/10-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Drops file in System32 directory
-