Severity
High
Analysis Summary
Emotet is a Trojan that is primarily spread through spam emails (malspam). The infection may arrive either via malicious script, macro-enabled document files, or malicious link. Emotet emails may contain familiar branding designed to look like a legitimate email. Emotet may try to persuade users to click the malicious files by using tempting language and click baits like “Your Invoice,” “Payment Details,” or possibly an upcoming shipment from well-known parcel companies. A fresher campaign is discovered distributing both the Emotet and the Trickbot malware. Indicators of compromise are given below.
Impact
- Credential theft
- Exposure of sensitive information
- Unauthorized Remote Access
Indicators of Compromise
MD5
- 1044750deccfe551caff847a98eb4b17
- 9ee1b22b752f25be9182a5d04cf90b3c
- c17722b468222c45bab8e6cdc83b0748
- 6b8ba6c385b150bf788faea38b3bf6d8
SHA-256
- 4ebe60b05162d6264ec0034d02e3ab01e062510a0f4344abbdc17524242d9a73
- 2a1fd547e8236424e46fa2482d3db48dc7de8e6efe84397ccc9582055e268e69
- 061dae2be3b5b2bf9c7fc9a16a92d6031e5dbda377b97e9f7371598ac67593f1
- 72a7981d188c5f8cfc12ea991cb8a4e968993cb63a9fedda6616766e0d2ee6d0
Source IP
- 51[.]159[.]23[.]217
- 66[.]85[.]173[.]43
- 193[.]26[.]217[.]243
- 71[.]126[.]247[.]90
- 164[.]68[.]120[.]56
- 64[.]71[.]35[.]51
- 187[.]190[.]47[.]173
- 188[.]227[.]84[.]209
- 45[.]79[.]223[.]161
- 91[.]236[.]4[.]234
- 172[.]221[.]229[.]86
- 123[.]31[.]31[.]47
- 203[.]176[.]135[.]102
- 98[.]239[.]119[.]52
- 120[.]151[.]194[.]117
- 195[.]123[.]219[.]69
- 195[.]123[.]240[.]37
- 80[.]86[.]91[.]91
URL
- http[:]//msek[.]lviv[.]ua/wp-includes/report/
- http[:]//msek[.]lviv[.]ua/
- http[:]//ingarden[.]lviv[.]ua/
Remediation
- Block the threat indicators at their respective controls.
- Do not download email attachments from untrusted emails.