General
-
Target
cZqbPkZZsIKxDxufIYMKJ.zip
-
Size
987KB
-
Sample
230324-p7gsysgd9w
-
MD5
bfbe074cd95ae548f1711f1cb8908220
-
SHA1
4e6f3a5a38a48e57fad456cff7cfee6a41360015
-
SHA256
0d89e04481015980b7b995e1abe11996bf7581bd77e38c6c62ec1de32b290dd3
-
SHA512
bf8aa8a86fd686be9d7d69e07359fc5f84734c5cf4b622918b64ca67d8b081e775b552e2e5be9754e7b8cd270d4d93401a579af582993dd952e5be17654e9385
-
SSDEEP
12288:Pkf5dOzheNdckFRKluvnRHXdhbDHfXZX1EKdxKmSTH4dep:8XzNdfKluvnRHthzfoYxJlQ
Malware Config
Extracted
emotet
Epoch4
213.239.212.5:443
129.232.188.93:443
103.43.75.120:443
197.242.150.244:8080
1.234.2.232:8080
110.232.117.186:8080
95.217.221.146:8080
159.89.202.34:443
159.65.88.10:8080
82.223.21.224:8080
169.57.156.166:8080
45.176.232.124:443
45.235.8.30:8080
173.212.193.249:8080
107.170.39.149:8080
119.59.103.152:8080
167.172.199.165:8080
91.207.28.33:8080
185.4.135.165:8080
104.168.155.143:8080
Targets
-
-
Target
VNl72xeYJnnQ183R.dll
-
Size
547MB
-
MD5
f8c68ffd87972e10d1f3cece3af3036b
-
SHA1
0bc013c70647ff68861ede6162441e15e6d525a0
-
SHA256
71635301df9bc1501e4bcfc7929edd9d080eafa6317b5383bf4c50d5fbd6dddd
-
SHA512
8fe9eb4e5dab003cf7bdc1196a7a3f31f03da5232c40a79526ad7c5e5fa669202e532f15e9a640d06b5dc11095ee29747c4f989b0f0b894c114f2cdbfc614c65
-
SSDEEP
12288:6iWi2RszBxSICcO5w6SudYEW/N4HTJ4NYu3cX:4inOcO5wJVETHTJwYusX
Score10/10-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Adds Run key to start application
-
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Modify Registry
1Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Registry Run Keys / Startup Folder
1Privilege Escalation