General
-
Target
Gmail fattura marzo.zip
-
Size
759KB
-
Sample
230309-nn1w2sba8x
-
MD5
7068babd8953f8fb3586f7d707f6473a
-
SHA1
d06cf44c8c8238dcdab6f8fbe9bcc2c93e005c23
-
SHA256
761e59d3308336631e70d13bfe7b4bd7187a1f8a1b9b6782490044a344d93448
-
SHA512
4f223d513e3ddc1723558e6c118146112c88c58bc5079ba702313fbf88b507a6700f60b696526751aeb94450e37e91bf57d6c3d37e011ba85428b4d30d62b86d
-
SSDEEP
6144:DkjM/ZrZPtRQhpuTec+hFF1NGJsCCmIivTF2f8bKm6zBA7FjAvxtR9ND:QMZr1YpblFHpCCmRBbKm6l02bbND
Malware Config
Extracted
emotet
Epoch4
129.232.188.93:443
164.90.222.65:443
159.65.88.10:8080
172.105.226.75:8080
115.68.227.76:8080
187.63.160.88:80
169.57.156.166:8080
185.4.135.165:8080
153.126.146.25:7080
197.242.150.244:8080
139.59.126.41:443
186.194.240.217:443
103.132.242.26:8080
206.189.28.199:8080
163.44.196.120:8080
95.217.221.146:8080
159.89.202.34:443
119.59.103.152:8080
183.111.227.137:8080
201.94.166.162:443
Targets
-
-
Target
fattura marzo.doc
-
Size
513.4MB
-
MD5
b0bcb1e7dfb7585c88a9a2ad1e9d14db
-
SHA1
9c083d0bf2e5eb67f451e6df50123f6f7170b8cf
-
SHA256
845e1c52d3af4897bd80778bb3a3cce94b87a1ed444572206f16198750c25267
-
SHA512
45328ccca917f9ee25322681b06efca5e0a02b1831a7cc0723555d3f32e6bb9f5c5322bd13a37425f5cb3d16a5449ec5a65451d05c3ee972a8702d54d5aaded4
-
SSDEEP
6144:ogJI9kbGiyDlVYoD2qe2qBgYZDyc+1Jg+CHf8biy/xllXQQgI2V:suyvDlGoUXZDyc0HCHf2Jxpg
Score10/10-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Loads dropped DLL
-