General
-
Target
hAv6jCxroyQIUlQoHH.zip
-
Size
958KB
-
Sample
230322-km6t5afg98
-
MD5
664cbe7538fe6af745ff2215c42710b8
-
SHA1
c76bc883848ab8765bfd7a6393990683395cc31e
-
SHA256
8191369e73a40c93d1f133c14f9c351d90fbc7c7298ddd7c1f8d96c64dd7c6dd
-
SHA512
bcb80c66104c0939b83f2dabb95fe0252728ef4ab4324e4e660a872510b839702c4a52a1e556353e7d0bc49c3d44bc06f7786bbf9da87ef802b77c00a45337e8
-
SSDEEP
12288:+kf5dOzheNdckFRKluvnRHXdhbDHfXZX1EKdxKmSTH4deY:tXzNdfKluvnRHthzfoYxJll
Malware Config
Extracted
emotet
Epoch4
213.239.212.5:443
129.232.188.93:443
103.43.75.120:443
197.242.150.244:8080
1.234.2.232:8080
110.232.117.186:8080
95.217.221.146:8080
159.89.202.34:443
159.65.88.10:8080
82.223.21.224:8080
169.57.156.166:8080
45.176.232.124:443
45.235.8.30:8080
173.212.193.249:8080
107.170.39.149:8080
119.59.103.152:8080
167.172.199.165:8080
91.207.28.33:8080
185.4.135.165:8080
104.168.155.143:8080
Targets
-
-
Target
oG5I7x0UMQTwPklcBJcuIPDEkg1z2U4i6.dll
-
Size
518.9MB
-
MD5
8d4ae113a4228abb787118fa7f080f07
-
SHA1
06484d09a45370765db7eec6a2998551215806f2
-
SHA256
5418335875ee09905dc49a03b4b38dbfa70c5902ec022814d45ec028be3b2975
-
SHA512
0944be85227173360689b18cc6bc58b7cc7017bba6291ad1ea696ecbc95f9d829d2e43e545ae9ecbb62159145f2e589bf463e553e1341fbc2d98cacdb6dde116
-
SSDEEP
12288:6iWi2RszBxSICcO5w6SudYEW/N4HTJ4NYu3cX:4inOcO5wJVETHTJwYusX
Score10/10-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Adds Run key to start application
-