General
-
Target
44-76912499472.zip
-
Size
1KB
-
Sample
220527-kjb6cahgh3
-
MD5
4ed0c0a6379aaf9781e2e7ccb0b0f738
-
SHA1
2ed6527cae4165135dd4c7e3b1f8067375f8aebd
-
SHA256
a96a59188fc527ee076437532a21d34e4b6c3d84a6abc9d1e576adbb50d7e133
-
SHA512
6e86af9f32b66954a6f8f7d7acbc71078b5393841d8fe6c69d205026cb39cf000775a22689b9e64cc0a435e396cf83065642bfd3c4fc3e5fa6eb170d10f147b6
Static task
static1
Behavioral task
behavioral1
Sample
44-76912499472.lnk
Resource
win7-20220414-en
Malware Config
Extracted
emotet
Epoch5
194.9.172.107:8080
66.42.57.149:443
165.22.73.229:8080
202.29.239.162:443
104.248.225.227:8080
54.38.242.185:443
103.133.214.242:8080
78.47.204.80:443
210.57.209.142:8080
103.41.204.169:8080
118.98.72.86:443
88.217.172.165:8080
87.106.97.83:7080
85.25.120.45:8080
195.77.239.39:8080
37.44.244.177:8080
36.67.23.59:443
160.16.143.191:7080
54.38.143.246:7080
159.69.237.188:443
68.183.93.250:443
54.37.228.122:443
190.90.233.66:443
37.59.209.141:8080
178.62.112.199:8080
59.148.253.194:443
196.44.98.190:8080
202.28.34.99:8080
78.46.73.125:443
51.68.141.164:8080
207.148.81.119:8080
93.104.209.107:8080
185.148.168.220:8080
103.85.95.4:8080
62.171.178.147:8080
175.126.176.79:8080
134.122.119.23:8080
202.134.4.210:7080
116.124.128.206:8080
45.71.195.104:8080
110.235.83.107:7080
103.56.149.105:8080
68.183.91.111:8080
5.56.132.177:8080
195.154.146.35:443
217.182.143.207:443
54.37.106.167:8080
85.214.67.203:8080
188.225.32.231:4143
103.42.58.120:7080
139.196.72.155:8080
Targets
-
-
Target
44-76912499472.lnk
-
Size
3KB
-
MD5
afa789a5a4197b43071da4d94067d346
-
SHA1
f5ef0b10c608fb042edae39919903b4c7510d49b
-
SHA256
9e90586b5881001bffc59e5ab90808e1470b787e1095052602cece861c0648d6
-
SHA512
2e5d94eb4d8d9fefe0dae56a7384673ae4f08ae1dc3f14bd63a01ca933689d555629b6b7acacb1b40a7ed0839ba99f9ce5f5e0791bdb09cb50b6dcb198a88808
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-