General
-
Target
Message-5170127.zip
-
Size
720KB
-
Sample
230314-ptplmsfc96
-
MD5
a061be238a373c7470bcefbc431203f1
-
SHA1
358484af2b40609951e66634cbd3209f1f14d39d
-
SHA256
8ed606fe3b8a930e7a50f48b48329594a37baa3cde85fbb3fdc62991eb2a41e4
-
SHA512
69ec3f798958b94cc69e36ab21ce881672f87559465d8efbe49d4aa923c68929dd72e0bf53e6717ba94519528e74ed7b77b3b9b875da65186c700f5241f8dfdc
-
SSDEEP
6144:UwZnDlMy6O3qKmCRUe1B5uLqcHfVDNUV3nJGM+BTf:ntDlb6IqXCRUe1BTcH8VIM+Vf
Malware Config
Extracted
emotet
Epoch5
103.85.95.4:8080
103.224.241.74:8080
178.238.225.252:8080
37.59.103.148:8080
78.47.204.80:443
138.197.14.67:8080
128.199.242.164:8080
54.37.228.122:443
37.44.244.177:8080
139.59.80.108:8080
218.38.121.17:443
82.98.180.154:7080
114.79.130.68:443
159.65.135.222:7080
174.138.33.49:7080
195.77.239.39:8080
193.194.92.175:443
198.199.70.22:8080
85.214.67.203:8080
93.84.115.205:7080
Targets
-
-
Target
Message-5170127.doc
-
Size
517.4MB
-
MD5
18d1f38fecd10fd9d1f33bf443fb68d3
-
SHA1
0c6ec212d472fe44ce988ca4af069d61175f0602
-
SHA256
2cc1bb74d3083ce25b7d662beb6f7cdda0e81701dd3d000fc56fe50246675e0e
-
SHA512
8548b9861c65766bbc4d8cf86c6ad51fe4b0a7ce048e538049893b55ed49cc21b4b60dbacfe9df2f0fedda9d5677cef9ad019d89e668c5cc24d7517c2c68fed0
-
SSDEEP
6144:5yk1RgZZXbN63GW1Z7krKSUzMNYJJdKkOl950uH54Lg4Ne9C:5/MXJ6WW1Z7ktUgNYJJdKkOHC4D409
Score10/10-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Loads dropped DLL
-
Adds Run key to start application
-