General
-
Target
enbg2jcZcuSzip0Bo2fIQdM4fi.zip
-
Size
978KB
-
Sample
230323-qxa34ahh6y
-
MD5
dac7d0750ed42258de8d80aa478e9f93
-
SHA1
a33969bf6233769bc05b090e1e7a59209a683b6a
-
SHA256
6aea832b89c99fc342381a418d21ac9b06204eabe8c5459874c57bf8c54c197d
-
SHA512
0153f9bbe284d1c2e1b9b53dcdd0b8da8b29db62d8b6b59dd587f5b134a69be0bf6b17a630f77c9626211d5ca731075a6abb1f04f9a3838db0696e50f4716aa1
-
SSDEEP
12288:okf5dOzheNdckFRKluvnRHXdhbDHfXZX1EKdxKmSTH4dex:rXzNdfKluvnRHthzfoYxJla
Malware Config
Extracted
emotet
Epoch4
213.239.212.5:443
129.232.188.93:443
103.43.75.120:443
197.242.150.244:8080
1.234.2.232:8080
110.232.117.186:8080
95.217.221.146:8080
159.89.202.34:443
159.65.88.10:8080
82.223.21.224:8080
169.57.156.166:8080
45.176.232.124:443
45.235.8.30:8080
173.212.193.249:8080
107.170.39.149:8080
119.59.103.152:8080
167.172.199.165:8080
91.207.28.33:8080
185.4.135.165:8080
104.168.155.143:8080
Targets
-
-
Target
cBw8S5DNQE9sNEQAvNd2K266vYwKaw.dll
-
Size
538.9MB
-
MD5
50150db8010ddc87150cb8445f45d270
-
SHA1
ba9241c0ec94568a3bb3bb938bf90b2d3abfaf1f
-
SHA256
f72a8aaff1ece757156621c9dd14b7dd056cc87ac78bb6b968da2f74197396ea
-
SHA512
6c36b7f8a456be984d5f520e011faa42592338659a75685ae5808644b1eda964ed2459e06cd2fb3b792d12352a7274061c4421336cdbfa88b2513e43f950b78b
-
SSDEEP
12288:6iWi2RszBxSICcO5w6SudYEW/N4HTJ4NYu3cX:4inOcO5wJVETHTJwYusX
Score10/10-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Adds Run key to start application
-