General
-
Target
PO 03082023.zip
-
Size
887KB
-
Sample
230313-kx7jeahe52
-
MD5
299b844b673268056e4ebd1c88694e08
-
SHA1
2f9799629d4780a32779bf81e080914efb9f904f
-
SHA256
460342a05051b974d40ef02b1db38920ccea1c3d675f3c0717bf52cfe8f0df45
-
SHA512
b4e07b96ba66fee258af56b2d7db0365f91771c3b226509b1a364b3071f3814ee892e691657fc1617c6469ff8b53e57d5a07926263e93fb7b9bee6315140f876
-
SSDEEP
6144:fIahm9n1uy/GnwjLlPVlwZ07Qpz5VvtMgcFqjlOwnERXQqEvFNNyqmmODY:fIznz/GnwjLltlwIKzz1DtwwAXEvxyFw
Malware Config
Extracted
emotet
Epoch4
164.68.99.3:8080
164.90.222.65:443
186.194.240.217:443
1.234.2.232:8080
103.75.201.2:443
187.63.160.88:80
147.139.166.154:8080
91.207.28.33:8080
5.135.159.50:443
153.92.5.27:8080
213.239.212.5:443
103.43.75.120:443
159.65.88.10:8080
167.172.253.162:8080
153.126.146.25:7080
119.59.103.152:8080
107.170.39.149:8080
183.111.227.137:8080
159.89.202.34:443
110.232.117.186:8080
Targets
-
-
Target
PO 03082023.doc
-
Size
519.6MB
-
MD5
eae07af58bf8661fb1a3ff24ffdb7d98
-
SHA1
496219e9ea5f5c0beee00311471853759028029a
-
SHA256
93fda5715150ad97dfd2e12320e7535360e07f05ea5f40a16c9f6bf73ece15e5
-
SHA512
6acc93a954018e6c515abe3d63ae381ee12457516c57a9e9df22cb1a90dd957c55bc811c3656c7af4d50e7c0194749fd2577c55565d6268903c5069e0176027e
-
SSDEEP
12288:sSVFHNUr1LCHFIAHrQk6VDL6P+4f1IzSmkuH3gv:sSVFH48HFIABZfSzQ
Score10/10-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Loads dropped DLL
-
Adds Run key to start application
-