General
-
Target
8a6effb1430c591fa0e6e8ac6f84b1991bf8cc18f70a432ae63e6bda131914c6
-
Size
106KB
-
Sample
220330-wx88sabfej
-
MD5
68e856165288a9bc99a681304b30d552
-
SHA1
c792461f287fc531967f0f56910b22263e597311
-
SHA256
8a6effb1430c591fa0e6e8ac6f84b1991bf8cc18f70a432ae63e6bda131914c6
-
SHA512
23ce7caa40df79663659a898129f25797946a1fe1ded6b970a2b1ef46a43061001d9c341be398be82b1265e7a78ae1251f9197668e008019ecb60ab95ffa7493
Malware Config
Extracted
https://www.gessersh.com/wp-includes/ZwQLepW/
http://www.garantihaliyikama.com/wp-admin/FjgB6I/
https://www.fantasticmotion.jp/_cnskin/qfWEQrrwBg/
http://dmcontabilidade.com/correspondentecaixa/TrS/
https://fcelik.nl/rittenregistratie/web/css/B3ILfU8Xk2SsEmT/
http://fanfield.co.uk/cgi-bin/7pp6DjWFNJXY8/
Extracted
https://www.gessersh.com/wp-includes/ZwQLepW/
Extracted
emotet
Epoch4
104.131.11.205:443
138.197.109.175:8080
187.84.80.182:443
79.143.187.147:443
189.232.46.161:443
51.91.76.89:8080
103.43.46.182:443
206.189.28.199:8080
45.176.232.124:443
107.182.225.142:8080
72.15.201.15:8080
209.250.246.206:443
164.68.99.3:8080
160.16.142.56:8080
134.122.66.193:8080
45.118.115.99:8080
183.111.227.137:8080
209.126.98.206:8080
1.234.2.232:8080
159.65.88.10:8080
Targets
-
-
Target
8a6effb1430c591fa0e6e8ac6f84b1991bf8cc18f70a432ae63e6bda131914c6
-
Size
106KB
-
MD5
68e856165288a9bc99a681304b30d552
-
SHA1
c792461f287fc531967f0f56910b22263e597311
-
SHA256
8a6effb1430c591fa0e6e8ac6f84b1991bf8cc18f70a432ae63e6bda131914c6
-
SHA512
23ce7caa40df79663659a898129f25797946a1fe1ded6b970a2b1ef46a43061001d9c341be398be82b1265e7a78ae1251f9197668e008019ecb60ab95ffa7493
Score10/10-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Loads dropped DLL
-
Drops file in System32 directory
-