5234d8010e2d4159f3e7f526bf2e0fff77aa9e8644d62e6c07680b173ea426e7.xls

Target

Size

78KB

Sample

220521-wqc7rsaed4

Score

10 ^/10

MD5

3a373bc4aa8ef7f65fdfa455173b5687

SHA1

3b179f1f1d0d2bcc8fa8074f5c8e36fbd3436014

SHA256

5234d8010e2d4159f3e7f526bf2e0fff77aa9e8644d62e6c07680b173ea426e7

SHA512

8e9a7acd52231fab6807d08ed125a99faceca65935050c1c53f64c19860ff30036da06b3da24b668190e4351aabebaa847fff7ea2e7663589470eb344d1901f4

Extracted

Language	xlm4.0
Source
URLs	https://hostal-alfonso12.com/clases/SKtPvv/ http://howesitgoing.com/images/HyaDnlbl6K7tbh2Lugys/ https://www.jdserralheria.com.br/cgi-bin/KFG6/ http://inteirado.com.br/fonts/7dJCVvuE5x3YrGQs2oJz/ http://iciee.untirta.ac.id/test/GccRw/ https://ideoso.com.tw/cgi-bin/zLrnBd2Eg1N3UVy5yL/ xlm40.dropper https://hostal-alfonso12.com/clases/SKtPvv/ xlm40.dropper http://howesitgoing.com/images/HyaDnlbl6K7tbh2Lugys/ xlm40.dropper https://www.jdserralheria.com.br/cgi-bin/KFG6/ xlm40.dropper http://inteirado.com.br/fonts/7dJCVvuE5x3YrGQs2oJz/ xlm40.dropper http://iciee.untirta.ac.id/test/GccRw/ xlm40.dropper https://ideoso.com.tw/cgi-bin/zLrnBd2Eg1N3UVy5yL/

Extracted

Language	xlm4.0
Source
URLs	https://hostal-alfonso12.com/clases/SKtPvv/ http://howesitgoing.com/images/HyaDnlbl6K7tbh2Lugys/ xlm40.dropper https://hostal-alfonso12.com/clases/SKtPvv/ xlm40.dropper http://howesitgoing.com/images/HyaDnlbl6K7tbh2Lugys/

Extracted

Family	emotet
Botnet	Epoch4
C2	131.100.24.231:80 103.132.242.26:8080 167.172.253.162:8080 149.56.131.28:8080 209.126.98.206:8080 188.44.20.25:443 212.237.17.99:8080 129.232.188.93:443 160.16.142.56:8080 46.55.222.11:443 1.234.2.232:8080 45.235.8.30:8080 185.157.82.211:8080 158.69.222.101:443 185.4.135.165:8080 27.54.89.58:8080 197.242.150.244:8080 153.126.146.25:7080 183.111.227.137:8080 103.75.201.2:443 45.118.115.99:8080 79.137.35.198:8080 172.104.251.154:8080 159.65.88.10:8080 203.114.109.124:443 101.50.0.91:8080 51.254.140.238:7080 206.189.28.199:8080 72.15.201.15:8080 150.95.66.124:8080 201.94.166.162:443 209.97.163.214:443 103.70.28.102:8080 185.8.212.130:7080 216.158.226.206:443 209.250.246.206:443 23.239.0.12:443 164.68.99.3:8080 102.222.215.74:443 134.122.66.193:8080 82.165.152.127:8080 51.91.76.89:8080 189.126.111.200:7080 146.59.226.45:443 163.44.196.120:8080 51.91.7.5:8080 58.227.42.236:80 167.99.115.35:8080 196.218.30.83:443 107.182.225.142:8080 151.106.112.196:8080 91.207.28.33:8080 94.23.45.86:4143 103.43.46.182:443 45.176.232.124:443 5.9.116.246:8080 173.212.193.249:8080 1.234.21.73:7080 212.24.98.99:8080 213.241.20.155:443 110.232.117.186:8080 77.81.247.144:8080 119.193.124.41:7080 131.100.24.231:80 103.132.242.26:8080 167.172.253.162:8080 149.56.131.28:8080 209.126.98.206:8080 188.44.20.25:443 212.237.17.99:8080 129.232.188.93:443 160.16.142.56:8080 46.55.222.11:443 1.234.2.232:8080 45.235.8.30:8080 185.157.82.211:8080 158.69.222.101:443 185.4.135.165:8080 27.54.89.58:8080 197.242.150.244:8080 153.126.146.25:7080 183.111.227.137:8080 103.75.201.2:443 45.118.115.99:8080 79.137.35.198:8080 172.104.251.154:8080 159.65.88.10:8080 203.114.109.124:443 101.50.0.91:8080 51.254.140.238:7080 206.189.28.199:8080 72.15.201.15:8080 150.95.66.124:8080 201.94.166.162:443 209.97.163.214:443 103.70.28.102:8080 185.8.212.130:7080 216.158.226.206:443 209.250.246.206:443 23.239.0.12:443 164.68.99.3:8080 102.222.215.74:443 134.122.66.193:8080 82.165.152.127:8080 51.91.76.89:8080 189.126.111.200:7080 146.59.226.45:443 163.44.196.120:8080 51.91.7.5:8080 58.227.42.236:80 167.99.115.35:8080 196.218.30.83:443 107.182.225.142:8080 151.106.112.196:8080 91.207.28.33:8080 94.23.45.86:4143 103.43.46.182:443 45.176.232.124:443 5.9.116.246:8080 173.212.193.249:8080 1.234.21.73:7080 212.24.98.99:8080 213.241.20.155:443 110.232.117.186:8080 77.81.247.144:8080 119.193.124.41:7080
eck1.plain
eck1.plain

Target

5234d8010e2d4159f3e7f526bf2e0fff77aa9e8644d62e6c07680b173ea426e7.xls

MD5

3a373bc4aa8ef7f65fdfa455173b5687

Filesize

78KB

Score

10^/10

SHA1

3b179f1f1d0d2bcc8fa8074f5c8e36fbd3436014

SHA256

5234d8010e2d4159f3e7f526bf2e0fff77aa9e8644d62e6c07680b173ea426e7

SHA512

8e9a7acd52231fab6807d08ed125a99faceca65935050c1c53f64c19860ff30036da06b3da24b668190e4351aabebaa847fff7ea2e7663589470eb344d1901f4

Signatures

Emotet
Description

Emotet is a trojan that is primarily spread through spam emails.
Tags

trojan banker emotet
Process spawned unexpected child process
Description

This typically indicates the parent process was compromised via an exploit or macro.
suricata: ET MALWARE W32/Emotet CnC Beacon 3
Description

suricata: ET MALWARE W32/Emotet CnC Beacon 3
Tags

suricata
Downloads MZ/PE file
Loads dropped DLL

Related Tasks

behavioral1 behavioral2

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

static1

macro xlm

8^/10

behavioral1

10^/10

behavioral2

emotet epoch4 banker suricata trojan

10^/10

Extracted

Extracted

Extracted

Tags

Signatures

Emotet

Description

Tags

Process spawned unexpected child process

Description

suricata: ET MALWARE W32/Emotet CnC Beacon 3

Description

Tags

Downloads MZ/PE file

Loads dropped DLL

Related Tasks

static1

behavioral1

behavioral2