Overview

overview

10

Static

static

8

2020-01-14...75.zip

windows7-x64

1

2020-01-14...75.zip

windows10-2004-x64

1

client/202...st.exe

windows7-x64

10

client/202...st.exe

windows10-2004-x64

10

client/202...-2.doc

windows7-x64

10

client/202...-2.doc

windows10-2004-x64

10

client/202...on.exe

windows7-x64

10

client/202...on.exe

windows10-2004-x64

10

client/202...ro.exe

windows7-x64

10

client/202...ro.exe

windows10-2004-x64

10

client/gpu...3C.exe

windows7-x64

10

client/gpu...3C.exe

windows10-2004-x64

10

client/gpu...tDll64

windows7-x64

1

client/gpu...tDll64

windows10-2004-x64

1

client/gpu...tDll64

windows7-x64

1

client/gpu...tDll64

windows10-2004-x64

1

client/gpu...s/dinj

windows7-x64

1

client/gpu...s/dinj

windows10-2004-x64

1

client/gpu.../dpost

windows7-x64

1

client/gpu.../dpost

windows10-2004-x64

1

client/gpu...s/sinj

windows7-x64

1

client/gpu...s/sinj

windows10-2004-x64

1

client/gpu...eDll64

windows7-x64

1

client/gpu...eDll64

windows10-2004-x64

1

client/gpu...mDll64

windows7-x64

1

client/gpu...mDll64

windows10-2004-x64

1

client/gpu...kDll64

windows7-x64

1

client/gpu...kDll64

windows10-2004-x64

1

client/gpu.../dpost

windows7-x64

1

client/gpu.../dpost

windows10-2004-x64

1

client/gpu...grab64

windows7-x64

1

client/gpu...grab64

windows10-2004-x64

1

Resubmissions

28-12-2022 03:05

221228-dk91fahc93 10

20-12-2022 19:37

221220-ycbswsea2x 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2020-01-14-malware-and-artifacts-from-Emotet-epoch-2-infection-with-Trickbot-gtag-mor75.zip

  • Size

    22.5MB

  • MD5

    58fd4df914ef17cd19f0bb03e709c5b9

  • SHA1

    fcb4c01c970f5b97076a5c93c9ebcc35358215bc

  • SHA256

    7a5d773aa6ef4cf71a18234e4037788e635a3f8aeefef0e9898d69453bc53025

  • SHA512

    b17f997d75597cfec942efdad3ac9e971d3c4a3e26a21a3a213d0235880b716882e45bdbb6b126b797350a42a73acc216512128421202575119975978766866d

  • SSDEEP

    393216:J3CH9KWwLtfI2nfIkuBvF6sbP5HlqjUGO0hXCYwLHOfitxfU3:5qxwpfI2nfIkuB0sbRYjUGvdwLUitVU3

Score
8/10
macro

Malware Config

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

    macro

Files

  • 2020-01-14-malware-and-artifacts-from-Emotet-epoch-2-infection-with-Trickbot-gtag-mor75.zip
    .zip

    Password: infected

  • client/2020-01-14-Trickbot-gtag-mor75-retrieved-by-Emotet-infected-host.exe
    .exe windows x86

    Password: infected

    35f4c90dc3c507b6ed0bba604da7a69d


    Headers

    Imports

    Sections

  • client/2020-01-14-Word-doc-with-macro-for-Emotet-epoch-2.doc
    .doc windows office2003

    Tbtzrchnmg

    Fvcjcvibfdajn

    Nkyoffriorkp

  • client/2020-01-14-follow-up-Emotet-binary-after-initial-infection.exe
    .exe windows x86

    a4e0347cbe5b367e305f6ccaae227862


    Headers

    Imports

    Sections

  • client/2020-01-14-initial-Emotet-binary-retrieved-by-Word-macro.exe
    .exe windows x86

    af10730eb37a87ffd6c2bb276575081a


    Headers

    Imports

    Sections

  • client/2020-01-14-registry-update-for-Emotet.txt
  • client/2020-01-14-scheduled-task-for-Trickbot-on-client.txt
  • client/gpuhealth/GƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe
    .exe windows x86

    35f4c90dc3c507b6ed0bba604da7a69d


    Headers

    Imports

    Sections

  • client/gpuhealth/data/importDll64
  • client/gpuhealth/data/injectDll64
  • client/gpuhealth/data/injectDll64_configs/dinj
  • client/gpuhealth/data/injectDll64_configs/dpost
  • client/gpuhealth/data/injectDll64_configs/sinj
  • client/gpuhealth/data/mshareDll64
  • client/gpuhealth/data/mwormDll64
  • client/gpuhealth/data/networkDll64
  • client/gpuhealth/data/networkDll64_configs/dpost
  • client/gpuhealth/data/pwgrab64
  • client/gpuhealth/data/pwgrab64_configs/dpost
  • client/gpuhealth/data/tabDll64
  • client/gpuhealth/data/tabDll64_configs/dpost
  • client/gpuhealth/settings.ini
  • client/gpuhealth/syrecrt.exe
    .exe windows x86

    d4848ec48b7ce9c2e15ea21654b55b72


    Headers

    Imports

    Sections

  • dc/2020-01-14-scheduled-task-for-Trickbot-on-DC.txt
  • dc/gpuhealth/data/NewBCtestnDll64
  • dc/gpuhealth/data/NewBCtestnDll64_configs/bcconfig3
  • dc/gpuhealth/data/importDll64
  • dc/gpuhealth/data/injectDll64
  • dc/gpuhealth/data/injectDll64_configs/dinj
  • dc/gpuhealth/data/injectDll64_configs/dpost
  • dc/gpuhealth/data/injectDll64_configs/sinj
  • dc/gpuhealth/data/mshareDll64
  • dc/gpuhealth/data/mwormDll64
  • dc/gpuhealth/data/networkDll64
  • dc/gpuhealth/data/networkDll64_configs/dpost
  • dc/gpuhealth/data/pwgrab64
  • dc/gpuhealth/data/pwgrab64_configs/dpost
  • dc/gpuhealth/data/tabDll64
  • dc/gpuhealth/data/tabDll64_configs/dpost
  • dc/gpuhealth/settings.ini
  • dc/gpuhealth/syrecrt.exe
    .exe windows x86

    d4848ec48b7ce9c2e15ea21654b55b72


    Headers

    Imports

    Sections