General
-
Target
untitled_14032023.zip
-
Size
704KB
-
Sample
230314-r39z2sga74
-
MD5
0215b6edbab6feb30f61e0969e222bec
-
SHA1
c213cb4798756e8c9c11749551f5809f3b008ed4
-
SHA256
9e3c0895682b32bb04a2021277e273e34217fb11997c6131bbf83054afd65568
-
SHA512
ad7dac12b4015986741d408bc28d81a35eeb653c165fe52f7c8ba1e695b0b950b79abb7fd4c9595cef5487e46272f6696d41bf5f5f28f1bbac349946d97194f8
-
SSDEEP
6144:swZnDlMy6O3qKmCRUe1B5uLqcHfVDNUV3nJGM+BTG:/tDlb6IqXCRUe1BTcH8VIM+VG
Malware Config
Extracted
emotet
Epoch5
103.85.95.4:8080
103.224.241.74:8080
178.238.225.252:8080
37.59.103.148:8080
78.47.204.80:443
138.197.14.67:8080
128.199.242.164:8080
54.37.228.122:443
37.44.244.177:8080
139.59.80.108:8080
218.38.121.17:443
82.98.180.154:7080
114.79.130.68:443
159.65.135.222:7080
174.138.33.49:7080
195.77.239.39:8080
193.194.92.175:443
198.199.70.22:8080
85.214.67.203:8080
93.84.115.205:7080
Targets
-
-
Target
untitled_14032023.doc
-
Size
501.4MB
-
MD5
50eb90f3e451375804fd9d98d6138cdc
-
SHA1
5b1619c3a35724b9ddd6665c49114f16b715dacd
-
SHA256
671860b937257d8c1112283d78357c8c7f4de998dfff62e8a13c7b80f4fe2676
-
SHA512
9d1d9035de7aa01ff612b20c12c12b4aebee9e4941269c6cddcf988acacedc270a288e5e0b5fe5447fb97be46b39776c3fe80e021c709b90d8c3091fae2668a8
-
SSDEEP
6144:5yk1RgZZXbN63GW1Z7krKSUzMNYJJdKkOl950uH54Lg4Ne9C:5/MXJ6WW1Z7ktUgNYJJdKkOHC4D409
Score10/10-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Loads dropped DLL
-