General
-
Target
zzzz.xls
-
Size
91KB
-
Sample
230117-wq5xsage8s
-
MD5
8d56f0ea9a3da60c3b7baaae0474c3f8
-
SHA1
f97b3d21b5b9d23ff256c80627284a501560bac1
-
SHA256
483041301968485f2f901734905ee021129f2bbd65a0e31141690c004e8d95f3
-
SHA512
cbcbfcaf7cebf3399f49ca457957c9f66cea54ac632e71f8827805a7026ec64793cc3208818780d47b2426253b86bc2736cabd91ab4eb8e1e7cd698400bcb9e3
-
SSDEEP
1536:rKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgGbCXuZH4gb4CEn9J4Z/Cs9om:rKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg2
Malware Config
Extracted
https://bosny.com/aspnet_client/R50QIOGjmvVlr/
http://navylin.com/autopoisonous/4fZQW/
http://asrani.garudaputih.com/nutabalong/bJYqoUIr99qNfoPDx/
http://db.rikaz.tech/lCx76IlkrBtEsqNFA7/zPYJzpOnzstNOiRHob/
Extracted
emotet
Epoch5
202.28.34.99:8080
80.211.107.116:8080
175.126.176.79:8080
218.38.121.17:443
139.196.72.155:8080
103.71.99.57:8080
87.106.97.83:7080
178.62.112.199:8080
64.227.55.231:8080
46.101.98.60:8080
54.37.228.122:443
128.199.217.206:443
190.145.8.4:443
209.239.112.82:8080
85.214.67.203:8080
198.199.70.22:8080
128.199.242.164:8080
178.238.225.252:8080
103.85.95.4:8080
103.126.216.86:443
Targets
-
-
Target
zzzz.xls
-
Size
91KB
-
MD5
8d56f0ea9a3da60c3b7baaae0474c3f8
-
SHA1
f97b3d21b5b9d23ff256c80627284a501560bac1
-
SHA256
483041301968485f2f901734905ee021129f2bbd65a0e31141690c004e8d95f3
-
SHA512
cbcbfcaf7cebf3399f49ca457957c9f66cea54ac632e71f8827805a7026ec64793cc3208818780d47b2426253b86bc2736cabd91ab4eb8e1e7cd698400bcb9e3
-
SSDEEP
1536:rKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgGbCXuZH4gb4CEn9J4Z/Cs9om:rKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg2
Score10/10-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Loads dropped DLL
-
Adds Run key to start application
-