Overview

overview

10

Static

static

8

2019-05-01...ts.zip

windows7-x64

1

2019-05-01...ts.zip

windows10-2004-x64

1

2019-05-01...ro.exe

windows7-x64

5

2019-05-01...ro.exe

windows10-2004-x64

10

2019-05-01...-2.exe

windows7-x64

10

2019-05-01...-2.exe

windows10-2004-x64

10

2019-05-01...-2.exe

windows7-x64

10

2019-05-01...-2.exe

windows10-2004-x64

10

2019-05-01...st.exe

windows7-x64

8

2019-05-01...st.exe

windows10-2004-x64

7

2019-05-01...nt.txt

windows7-x64

1

2019-05-01...nt.txt

windows10-2004-x64

1

2019-05-01...nt.txt

windows7-x64

1

2019-05-01...nt.txt

windows10-2004-x64

1

2019-05-01...19.doc

windows7-x64

10

2019-05-01...19.doc

windows10-2004-x64

10

2019-05-01...19.zip

windows7-x64

1

2019-05-01...19.zip

windows10-2004-x64

1

2019-05-01...tDll64

windows7-x64

1

2019-05-01...tDll64

windows10-2004-x64

1

2019-05-01...tDll64

windows7-x64

1

2019-05-01...tDll64

windows10-2004-x64

1

2019-05-01...s/dinj

windows7-x64

1

2019-05-01...s/dinj

windows10-2004-x64

1

2019-05-01.../dpost

windows7-x64

1

2019-05-01.../dpost

windows10-2004-x64

1

2019-05-01...s/sinj

windows7-x64

1

2019-05-01...s/sinj

windows10-2004-x64

1

2019-05-01...cher64

windows7-x64

1

2019-05-01...cher64

windows10-2004-x64

1

2019-05-01...ilconf

windows7-x64

1

2019-05-01...ilconf

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    2019-05-01-Emotet-and-Trickbot-malware-and-artifacts.zip

  • Size

    11.7MB

  • MD5

    9d6afea5fd7fd56405fc4dbd1170131d

  • SHA1

    0c294bece575234aeaff788ba7506537d0acfa01

  • SHA256

    69a2ab72eb15c6bc8cc6cbd3d66bb445821c822f41494b54c48bc94388fa1f0c

  • SHA512

    514cc2064deaba4f3dc5df59d879aa77dfe2e0b9c8b1bfd92c12296f2996a91ab1dfaa30668853f9200f7087add980d5d68aeef0dfa7638312cc1803c76f4dd0

  • SSDEEP

    196608:aP0P1L+jwvDGDlRmzvBOuQUNsc4KqIZlmMkbSrhkRKzZ/nEX2ivvfiZ4SZxBPeQB:aP0P1L+jqDg8BLsc4KqIZgMcSNTZ/nE+

Score
8/10
macro

Malware Config

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

    macro
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • 2019-05-01-Emotet-and-Trickbot-malware-and-artifacts.zip
    .zip

    Password: saf19

  • 2019-05-01-Emotet-and-Trickbot-malware-and-artifacts(1)/2019-05-01-Emotet-binary-retrieved-by-Word-macro.exe
    .exe windows x86

    Password: saf19

    1d002a346878e0bbec83859aa14cce23


    Code Sign

    Headers

    Imports

    Sections

  • 2019-05-01-Emotet-and-Trickbot-malware-and-artifacts(1)/2019-05-01-Emotet-binary-updated-after-initial-infection-1-of-2.exe
    .exe windows x86

    Password: saf19

    799ea882f6aeb8c90b34575111813eb3


    Code Sign

    Headers

    Imports

    Sections

  • 2019-05-01-Emotet-and-Trickbot-malware-and-artifacts(1)/2019-05-01-Emotet-binary-updated-after-initial-infection-2-of-2.exe
    .exe windows x86

    Password: saf19

    33f34ea3fc5507a0335080470b85e7e2


    Code Sign

    Headers

    Imports

    Sections

  • 2019-05-01-Emotet-and-Trickbot-malware-and-artifacts(1)/2019-05-01-Trickbot-malware-retrieved-by-Emotet-infected-host.exe
    .exe windows x86

    Password: saf19

    ff3b738f94625ab18a68510801b5f71d


    Headers

    Imports

    Sections

  • 2019-05-01-Emotet-and-Trickbot-malware-and-artifacts(1)/2019-05-01-registry-update-to-keep-Emotet-persistent.txt
  • 2019-05-01-Emotet-and-Trickbot-malware-and-artifacts(1)/2019-05-01-sched-task-to-keep-Trickbot-persistent.txt
  • 2019-05-01-Emotet-and-Trickbot-malware-and-artifacts(1)/40606534706_May_01_2019.doc
    .doc windows office2003

    MADQAZBX

    zA_GcBBC

    lAZoQGB

    jGDAwAA

    aAAXxQAo

    BxABBwA

    zCA_U1A

    rZAxCUB

    FCxXwA

  • 2019-05-01-Emotet-and-Trickbot-malware-and-artifacts(1)/40606534706_May_01_2019.zip
    .zip
  • 2019-05-01-Emotet-and-Trickbot-malware-and-artifacts(1)/GpuSettings/Data/importDll64
  • 2019-05-01-Emotet-and-Trickbot-malware-and-artifacts(1)/GpuSettings/Data/injectDll64
  • 2019-05-01-Emotet-and-Trickbot-malware-and-artifacts(1)/GpuSettings/Data/injectDll64_configs/dinj
  • 2019-05-01-Emotet-and-Trickbot-malware-and-artifacts(1)/GpuSettings/Data/injectDll64_configs/dpost
  • 2019-05-01-Emotet-and-Trickbot-malware-and-artifacts(1)/GpuSettings/Data/injectDll64_configs/sinj
  • 2019-05-01-Emotet-and-Trickbot-malware-and-artifacts(1)/GpuSettings/Data/mailsearcher64
  • 2019-05-01-Emotet-and-Trickbot-malware-and-artifacts(1)/GpuSettings/Data/mailsearcher64_configs/mailconf
  • 2019-05-01-Emotet-and-Trickbot-malware-and-artifacts(1)/GpuSettings/Data/networkDll64
  • 2019-05-01-Emotet-and-Trickbot-malware-and-artifacts(1)/GpuSettings/Data/networkDll64_configs/dpost
  • 2019-05-01-Emotet-and-Trickbot-malware-and-artifacts(1)/GpuSettings/Data/psfin64
  • 2019-05-01-Emotet-and-Trickbot-malware-and-artifacts(1)/GpuSettings/Data/psfin64_configs/dpost
  • 2019-05-01-Emotet-and-Trickbot-malware-and-artifacts(1)/GpuSettings/Data/pwgrab64
  • 2019-05-01-Emotet-and-Trickbot-malware-and-artifacts(1)/GpuSettings/Data/pwgrab64_configs/dpost
  • 2019-05-01-Emotet-and-Trickbot-malware-and-artifacts(1)/GpuSettings/Data/shareDll64
  • 2019-05-01-Emotet-and-Trickbot-malware-and-artifacts(1)/GpuSettings/Data/systeminfo64
  • 2019-05-01-Emotet-and-Trickbot-malware-and-artifacts(1)/GpuSettings/ng0UTZoBwEptBZGtus.exe
    .exe windows x86

    ff3b738f94625ab18a68510801b5f71d


    Headers

    Imports

    Sections

  • 2019-05-01-Emotet-and-Trickbot-malware-and-artifacts(1)/GpuSettings/settings.ini