General
-
Target
sample.zip
-
Size
171KB
-
Sample
230327-cl5xfadb9t
-
MD5
7627c881595bdbbc5c76157ba79480c8
-
SHA1
ae1bbeceb8cbb93241d9496b0eabd2c3987f1922
-
SHA256
3b5610f55a07eef82a8ac66974e8b5e2dddc9ee5d80c97c6146a6824a777beae
-
SHA512
493d94ac6228b9e46299a8aa3a047386f0a04556a6f0a8b23c36eac098dd7b8804112bdc3c7b019c7fa8303dce69165580645e865dbb9ef115c7147bcc693f77
-
SSDEEP
3072:351WXTOd3T39Os/eQ6SYghBXtc46E0IQuYT45+wAQDCHtpLgZW5CLYb8:6DOp3Us/eQ65ghBnf0JuYT4rnDCDgZWO
Malware Config
Extracted
emotet
Epoch4
164.68.99.3:8080
164.90.222.65:443
186.194.240.217:443
1.234.2.232:8080
103.75.201.2:443
187.63.160.88:80
147.139.166.154:8080
91.207.28.33:8080
5.135.159.50:443
153.92.5.27:8080
213.239.212.5:443
103.43.75.120:443
159.65.88.10:8080
167.172.253.162:8080
153.126.146.25:7080
119.59.103.152:8080
107.170.39.149:8080
183.111.227.137:8080
159.89.202.34:443
110.232.117.186:8080
Targets
-
-
Target
e3022f6351f14f918391ca9384925318fc863eea17044ac0904cfbc689e0616c
-
Size
698KB
-
MD5
d7b133011b9daeae2a7af05dcac235c3
-
SHA1
9d538abae3bc2009b508101bc86498763ec9dc97
-
SHA256
e3022f6351f14f918391ca9384925318fc863eea17044ac0904cfbc689e0616c
-
SHA512
b405038d2d5f4cc48d00fd0b533fdfa8061985bd139c42e225fca11cd428a34795070867bd33da621fa6eae23e2ebadfd4310a063c4291c77ccef3cd326d5ca7
-
SSDEEP
3072:OJPwOBqguhRok0EOsHYQLMTwyOy2w4OLWxKJ5SuNVWla3o:CjTuh1OVQTy/LWq7WlaY
Score1/10 -
-
-
Target
08032023.doc
-
Size
525MB
-
MD5
d2dee88803a04a6457a9c62840e53223
-
SHA1
1be346c29ae7d0bfa91b50532bd16bba6c0bf624
-
SHA256
eaf050eabdfffde46a85a1651438dbbae8a3e048090c80f231efddef019895a0
-
SHA512
42e7a7dc77e54575563378be4f605baaee5fe7df2ffb823caeec1c06eae140e5bcaa34c74def12ebc8c8eb274be30e5b9c2eb696f13c0b4b0d410867acf5eea7
-
SSDEEP
3072:2JX29m8QBUoItA/leC6gSJ+2JiclnUOvrRxqmLcHeNJxPkdVdTRcDK6:2EmleC6gSJWclU0RxVLcHe5cdTR
Score10/10-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Loads dropped DLL
-
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Modify Registry
1Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation