General
-
Target
17_62561.zip
-
Size
644KB
-
Sample
230307-vkmzcaac5x
-
MD5
8964a6a0fee733cf456239f8d16a24a1
-
SHA1
f5146cc4005587970ce4dbbb09a15b9c8771869d
-
SHA256
c6d750d9cae9fcd030fe2c95a4755e250430d5b0d9351661d9593aeaeb020d5a
-
SHA512
ad078417b3776347dc677b8cd1b5aa811d20d252adfbd948bae4342fba45c43e3da59f59c5936705d530ec38bb7ac38bb4d5e417713839d0ce96aaa0618db740
-
SSDEEP
3072:J1lsI//z4a/hGS0NclN3U8XKp5ZuoWkQQhl0GEzal3CX:J12c/z4a5GLNIp1WMkd3tCX
Malware Config
Extracted
emotet
Epoch4
129.232.188.93:443
164.90.222.65:443
159.65.88.10:8080
172.105.226.75:8080
115.68.227.76:8080
187.63.160.88:80
169.57.156.166:8080
185.4.135.165:8080
153.126.146.25:7080
197.242.150.244:8080
139.59.126.41:443
186.194.240.217:443
103.132.242.26:8080
206.189.28.199:8080
163.44.196.120:8080
95.217.221.146:8080
159.89.202.34:443
119.59.103.152:8080
183.111.227.137:8080
201.94.166.162:443
Targets
-
-
Target
17_62561.doc
-
Size
525.2MB
-
MD5
8639c3d193b8211d1fe561b896716f89
-
SHA1
508d00b731259c63a1e7aaa1030e96a62f4c241a
-
SHA256
988d82d5b1032b465b0e0c3b60fd5f822209f4cdc9ab04de91139be98dac9ecd
-
SHA512
9fc1773a40eb49f063f2ecab55f91c8851f320b26918305a05a310411289c08f9053af26389e3e24195804b405a7d358facffbd720bfbc1e7996262bb4d47030
-
SSDEEP
3072:eoEW2aOtFjH0lP2IpjctfRcVVwEi/A8NVM1wIOCbX6bYLjWFJuvx7ueK6:ZE1aOtFa2I9c3aVw4zwxCbJ4Jup
Score10/10-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Loads dropped DLL
-