General
-
Target
86308195412271607262.zip
-
Size
684KB
-
Sample
230310-k98x1aec2y
-
MD5
44e42a217a813fc756ca294801cf441b
-
SHA1
ced4ea8ff048de13868b58cb0d8a59fdccf7adac
-
SHA256
90a728eaefb274bc653816ba773223cca01948a7fcdd8d9d7159440637850da6
-
SHA512
3edbc832737a07b8e277a9404dbbb30a5e381b3d345311b36c541caaf469370893aeca3034192c29f5d617aaaec90911fed1e7471ad7293244d4b0b0795760ed
-
SSDEEP
3072:/TdhlKitY6gngARvVndTW9ZCPuJSDCKvjl1flV+crxAm40/yL/sEZGNKl/q:5hQOY6egwndgkPwSDCKFVj+mb/yFIs/q
Malware Config
Extracted
emotet
Epoch4
164.68.99.3:8080
164.90.222.65:443
186.194.240.217:443
1.234.2.232:8080
103.75.201.2:443
187.63.160.88:80
147.139.166.154:8080
91.207.28.33:8080
5.135.159.50:443
153.92.5.27:8080
213.239.212.5:443
103.43.75.120:443
159.65.88.10:8080
167.172.253.162:8080
153.126.146.25:7080
119.59.103.152:8080
107.170.39.149:8080
183.111.227.137:8080
159.89.202.34:443
110.232.117.186:8080
Targets
-
-
Target
Electronic form.doc
-
Size
525.3MB
-
MD5
d928f6411afcbbd0a2dc09874992af61
-
SHA1
0ad3ad58fbd02af5afd63b8e83f07b419279d6b2
-
SHA256
cf75658820882708b48e20fcd2f020069f69581b207d6f81a0bfd00b26134224
-
SHA512
e878dc70b4de7dcd1e141a35fcd330083165ba087efd2c8792e6272b786e91e2ea3154159a383df0df5dbad582ce96f884b61929c4d42eca4db58eb1d4ab2545
-
SSDEEP
6144:jkmCUX1RauEA55axdWFyDDIqqmbwbLUW:omC7uz552AFZqXbwbA
Score10/10-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Loads dropped DLL
-