General
-
Target
comments 832.zip
-
Size
673KB
-
Sample
230309-ps4zyabc7s
-
MD5
118375fb8b6e655dd06eb03202579d73
-
SHA1
29edde3958b15689a3a240c52628021c3365e963
-
SHA256
2f772fd2a28c0b53356d25e79af89ed9993b90f22dbaa1eb4b5849eb0b9a72f9
-
SHA512
108d5d31aea7bf1fbd4cb72fcc94a67f225eff2875b48bb98a915010d080c1679c619689b78a38526f7187881b832883a958fd7269d3aca37b555e14f86b68ec
-
SSDEEP
3072:CJPwOBqguhRok0EOsHYQLMTwyOy2w4OLWxKJ5SuNVWla3O:ujTuh1OVQTy/LWq7Wlae
Malware Config
Extracted
emotet
Epoch4
129.232.188.93:443
164.90.222.65:443
159.65.88.10:8080
172.105.226.75:8080
115.68.227.76:8080
187.63.160.88:80
169.57.156.166:8080
185.4.135.165:8080
153.126.146.25:7080
197.242.150.244:8080
139.59.126.41:443
186.194.240.217:443
103.132.242.26:8080
206.189.28.199:8080
163.44.196.120:8080
95.217.221.146:8080
159.89.202.34:443
119.59.103.152:8080
183.111.227.137:8080
201.94.166.162:443
Targets
-
-
Target
PO 2023-03-08_0827, United States.doc
-
Size
500.3MB
-
MD5
04167b66dad818acca25dd5c5a177e8b
-
SHA1
638734594d243a9627ab8c16f867a7d0f741c75c
-
SHA256
ea55eac0221c35e657fdca5d6f893053a296ea678d0a44d9ac2112f5a88ceaa7
-
SHA512
61688bdcda4c92a9f24320e1eeaaaeefd8d57359f3b46c61194f60fb3cb9cac2878cb25a45b750a988a4b6be6709189273871d8a37dc7acb23eaffb91313644a
-
SSDEEP
3072:2JX29m8QBUoItA/leC6gSJ+2JiclnUOvrRxqmLcHeNJxPkdVdTRcDK6:2EmleC6gSJWclU0RxVLcHe5cdTR
Score10/10-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Loads dropped DLL
-
Adds Run key to start application
-