General
-
Target
Rechnung 2023.14.03_1221 Satgurutravel.zip
-
Size
687KB
-
Sample
230314-nj75kafb29
-
MD5
3e1602eedd752e32357095ab39870552
-
SHA1
6b578740c7f8481c5c7cb2c90851cc28833fa941
-
SHA256
d990e1e0badc8df7ad5e49f7a5c321f7b5c387419d4d17bc8c8008887a8adb86
-
SHA512
1b02c1bfcbd8f88f278877a3e445d3788bd4476bccb8f0bdccbd75aa680f5fcbe136849df733f610db89cf7aa519f623ed02fc4a88ed876d15841bacd69a0eb9
-
SSDEEP
3072:vIFb4Wmkqke+cEeqH9vH+i2s1Vj8JxuLVpMs75XLKZvg:vOykqk6Lw+i2s1Vjkxuxp/Qvg
Malware Config
Extracted
emotet
Epoch4
164.68.99.3:8080
164.90.222.65:443
186.194.240.217:443
1.234.2.232:8080
103.75.201.2:443
187.63.160.88:80
147.139.166.154:8080
91.207.28.33:8080
5.135.159.50:443
153.92.5.27:8080
213.239.212.5:443
103.43.75.120:443
159.65.88.10:8080
167.172.253.162:8080
153.126.146.25:7080
119.59.103.152:8080
107.170.39.149:8080
183.111.227.137:8080
159.89.202.34:443
110.232.117.186:8080
Targets
-
-
Target
Rechnung 2023.14.03_1221.doc
-
Size
533.3MB
-
MD5
3c34e353986f6a94f20e081132736c43
-
SHA1
116c23c50f372567952281ba78caba51862707d1
-
SHA256
1f7ad39b9afd918270f59f92763d127334c09b61a18ba71443e7e4db64f066a3
-
SHA512
3957cc11d142732f759196f5cd392f2a58674911bd0ab567c39dfca43a6a9ea273690b41675804b89788dfc150ae00f41df2d1e7c4bb6433e61b7c58169bfea3
-
SSDEEP
6144:1620tqUx3Xu+7ZkRIDNGi9a0Va5UAClo:1620tqm3+I2ezcz5U3lo
Score10/10-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Loads dropped DLL
-