General
-
Target
31fb4bf411dcd7fcb860bdb1db26859290b047b39b94638a7d4fd2a46d323e98.zip
-
Size
16KB
-
Sample
230324-v8nksagc76
-
MD5
0d102c1395a61995ee88b68b72153291
-
SHA1
f0c7bb3c32bf7b30fa54dd99fde05837e8d6569b
-
SHA256
19e6c83f43d260af47dd46c9ca4b02b5fe33f0c0ff926572a34b54d06a323eeb
-
SHA512
988fd83b6a087d9ae18efef6f159ed43cb28b6e93abb7c6d2c8cb32f0e49d07e52960704246018ef0b1c6bf11f4c6efb4b016180d820fcee1b2f4b3e2103d84b
-
SSDEEP
384:neBuQks8P0Vac5tV6PkX+1QrfEj64ToXclp2qcMUqh3oCok7NuExKZ2EEnltCb6o:eMQYSacvYT4E24ToslwNy4bkRuaREOC5
Malware Config
Extracted
emotet
Epoch4
213.239.212.5:443
129.232.188.93:443
103.43.75.120:443
197.242.150.244:8080
1.234.2.232:8080
110.232.117.186:8080
95.217.221.146:8080
159.89.202.34:443
159.65.88.10:8080
82.223.21.224:8080
169.57.156.166:8080
45.176.232.124:443
45.235.8.30:8080
173.212.193.249:8080
107.170.39.149:8080
119.59.103.152:8080
167.172.199.165:8080
91.207.28.33:8080
185.4.135.165:8080
104.168.155.143:8080
Targets
-
-
Target
31fb4bf411dcd7fcb860bdb1db26859290b047b39b94638a7d4fd2a46d323e98.mal_
-
Size
88KB
-
MD5
9eae6f49a02d6eb9f75af7bbf4349808
-
SHA1
2caf7ddeb9fc1d6076558661ef69b9638cfd2e7b
-
SHA256
31fb4bf411dcd7fcb860bdb1db26859290b047b39b94638a7d4fd2a46d323e98
-
SHA512
37b45c58efd8c2bee66c30bca4a3777d5b6ba39e97d34baa8e7bc27fb083397d818a2708cbcf7d4704398fdfff4cbc17abff68b33294292413527702c1ad7eef
-
SSDEEP
768:vvQxmTUdOGFf77IlCpfj2d7gtD/uqDX4l8EE1:vvQxxOGV77Fj2sDRX4lG1
Score10/10-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Blocklisted process makes network request
-
Loads dropped DLL
-
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation