General
-
Target
f19d159a075a6ab2f063e01922822699fb70cee79f8b1b3853017ff57e700f00.zip
-
Size
124KB
-
Sample
230310-nerxsadb52
-
MD5
572ec2ea94dcc07ade4fe542e8f2d680
-
SHA1
2c683e3da39c7747be192889f83bd66d4404b59e
-
SHA256
e0571494d2e6bb0f9074704db9d9c9297cbac5544cc15bf62c3a34e1da81cd5b
-
SHA512
78678d735a10a68e1cb7840520dbb64c65b23be3208d33f87aae7a9f7218f1ebcd7d360033699cbc02f555f2dc8570921c95a143090d01b64313b9f2ca66f771
-
SSDEEP
3072:/uS5K246y5U2bJTTLS5nK6Kvtxn31Xhl/UfE2PxgT:GS5npIVnanKpvFXTUVPuT
Malware Config
Extracted
emotet
Epoch4
164.68.99.3:8080
164.90.222.65:443
186.194.240.217:443
1.234.2.232:8080
103.75.201.2:443
187.63.160.88:80
147.139.166.154:8080
91.207.28.33:8080
5.135.159.50:443
153.92.5.27:8080
213.239.212.5:443
103.43.75.120:443
159.65.88.10:8080
167.172.253.162:8080
153.126.146.25:7080
119.59.103.152:8080
107.170.39.149:8080
183.111.227.137:8080
159.89.202.34:443
110.232.117.186:8080
Targets
-
-
Target
DETALLES_2562.doc
-
Size
540.2MB
-
MD5
5044553467b5553505acb52ce47e92c7
-
SHA1
74688fc37b7ca6938ff26ba73b0433f4f61eb41b
-
SHA256
2a5d629a4645bf7e5a38f790f411fdbc96fa0ca814d04d27892421993caf4adb
-
SHA512
8b4d9360e0099b7d73c0aa90e0f09f0f2f15fdf993b9f7f79ebf0f304c4f374e054bdb2e2c30593c592ac6f24938e219be40fe7447b3c76d32ac5cdd59bde6da
-
SSDEEP
3072:eoEW2aOtFjH0lP2IpjctfRcVVwEi/A8NVM1wIOCbX6bYLjWFJuvx7ueK6:ZE1aOtFa2I9c3aVw4zwxCbJ4Jup
Score10/10-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Loads dropped DLL
-
Adds Run key to start application
-