General
-
Target
4373179537.zip
-
Size
736KB
-
Sample
230314-qlk4xshe2t
-
MD5
f22108b9413c684cd5a920c80b025177
-
SHA1
5afb0ae19f15c50f774e4707b725fb32c6313140
-
SHA256
4879d68f64e84f0fb5b64b2dd212f76462a01f8e10f4d8ed6287cac8421e589c
-
SHA512
26f1a73396fed83683eec8409724b46095cab6e387565d58f3f4fa7e4ec712839e086865e9c9787c3fd518413405aca90c4aea274bd23e2c9d92bb80460adfa0
-
SSDEEP
6144:QwZnDlMy6O3qKmCRUe1B5uLqcHfVDNUV3nJGM+BT/:DtDlb6IqXCRUe1BTcH8VIM+V/
Malware Config
Extracted
emotet
Epoch5
103.85.95.4:8080
103.224.241.74:8080
178.238.225.252:8080
37.59.103.148:8080
78.47.204.80:443
138.197.14.67:8080
128.199.242.164:8080
54.37.228.122:443
37.44.244.177:8080
139.59.80.108:8080
218.38.121.17:443
82.98.180.154:7080
114.79.130.68:443
159.65.135.222:7080
174.138.33.49:7080
195.77.239.39:8080
193.194.92.175:443
198.199.70.22:8080
85.214.67.203:8080
93.84.115.205:7080
Targets
-
-
Target
4373179537.doc
-
Size
533.4MB
-
MD5
9fbce537ab324aa323e681b6b0024492
-
SHA1
b5626da4171f32811440381d01392db523e69118
-
SHA256
e7664734d76bfd668aeb42789758976d72086e2dfd408b96f6b3c0d84d395e88
-
SHA512
1736d2aaee14543db22dacc34477f341d3c5f45b02d95492ef59127b6568378905adef976386ddaf945db9ea1e8d4109267928719372ba5a68d072afdfc76859
-
SSDEEP
6144:5yk1RgZZXbN63GW1Z7krKSUzMNYJJdKkOl950uH54Lg4Ne9C:5/MXJ6WW1Z7ktUgNYJJdKkOHC4D409
Score10/10-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Loads dropped DLL
-