2018-06-12 - EMOTET MALSPAM AND INFECTION TRAFFIC

ASSOCIATED FILES:

  • 2018-06-12-Emotet-malspam-1258-UTC.eml   (1,446 bytes)
  • 2018-06-12-Emotet-malspam-1614-UTC.eml   (1,784 bytes)
  • 2018-06-12-Emotet-malspam-1626-UTC.eml   (1,209 bytes)
  • 2018-06-12-Emotet-malspam-1749-UTC.eml   (1,182 bytes)
  • 2018-06-12-Emotet-malspam-1818-UTC.eml   (1,355 bytes)
  • 2018-06-12-Emotet-malspam-1821-UTC.eml   (1,743 bytes)
  • 2018-06-12-Emotet-malspam-1936-UTC.eml   (134,520 bytes)
  • 2018-06-12-Emotet-malspam-1940-UTC.eml   (1,286 bytes)
  • 2018-06-12-Emotet-malspam-2038-UTC.eml   (1,000 bytes)
  • 2018-06-12-Emotet-malspam-2046-UTC.eml   (845 bytes)
  • 2018-06-12-Emotet-malspam-infection-traffic-with-Zeus-Panda-Banker.pcap   (4,823,683 bytes)/li>
  • 2018-06-12-Emotet-executable-1-of-5.exe   (274,432 bytes)
  • 2018-06-12-Emotet-executable-2-of-5.exe   (143,360 bytes)
  • 2018-06-12-Emotet-executable-3-of-5.exe   (143,360 bytes)
  • 2018-06-12-Emotet-executable-4-of-5.exe   (143,360 bytes)
  • 2018-06-12-Emotet-executable-5-of-5.exe   (287,744 bytes)
  • 2018-06-12-Word-document-with-macro-for-emotet-1-of-12.doc   (104,448 bytes)
  • 2018-06-12-Word-document-with-macro-for-emotet-10-of-12.doc   (123,648 bytes)
  • 2018-06-12-Word-document-with-macro-for-emotet-11-of-12.doc   (96,000 bytes)
  • 2018-06-12-Word-document-with-macro-for-emotet-12-of-12.doc   (99,840 bytes)
  • 2018-06-12-Word-document-with-macro-for-emotet-2-of-12.doc   (92,416 bytes)
  • 2018-06-12-Word-document-with-macro-for-emotet-3-of-12.doc   (119,296 bytes)
  • 2018-06-12-Word-document-with-macro-for-emotet-4-of-12.doc   (110,336 bytes)
  • 2018-06-12-Word-document-with-macro-for-emotet-5-of-12.doc   (98,048 bytes)
  • 2018-06-12-Word-document-with-macro-for-emotet-6-of-12.doc   (104,192 bytes)
  • 2018-06-12-Word-document-with-macro-for-emotet-7-of-12.doc   (94,976 bytes)
  • 2018-06-12-Word-document-with-macro-for-emotet-8-of-12.doc   (123,392 bytes)
  • 2018-06-12-Word-document-with-macro-for-emotet-9-of-12.doc   (91,136 bytes)
  • 2018-06-12-Zeus-Panda-Banker-caused-by-Emotet-infection.exe   (275,456 bytes)

 


Shown above:  Sometimes there's also a PDF document when we see an attached Word document.  In this case, the PDF document was harmless.
It merely had text stating "Payroll reports are attached to this e-mail."

 

WEB TRAFFIC BLOCK LIST

URLS FROM THE MALSPAM TO RETRIEVE THE WORD DOCS:

 

URLS GENERATED BY THE WORD MACROS TO RETRIEVE EMOTET:

 

DOMAIN FOR HTTPS/SSL/TLS TRAFFIC CAUSED BY ZEUS PANDA BANKER:

 

EMAILS


Shown above:  Example of the IRS-themed Emotet malspam.

 


Shown above:  Example of Emotet malspam with an attached Word doc instead of a link.

 

DATA FROM 10 EMAIL EXAMPLES OF THE MALSPAM:

 


Shown above:  One of the downloaded (or attached) Word docs.

 


Shown above:  The attached PDF file from that one malspam message.

 

INFECTION TRAFFIC


Shown above:  Traffic from an infection filtered in Wireshark.

 

TRAFFIC FROM AN INFECTED WINDOWS HOST:

 

SHA256 HASHES

DOWNLOADED WORD DOCUMENTS FROM LINKS IN THE MALSPAM:

 

EMOTET EXECUTABLE FILES RETRIEVED BY THE WORD MARCOS:

 

ZEUS PANDA BANKER SEEN DURING EMOTET INFECTION:

 

FINAL NOTES

Once again, here are the associated files:

Zip archives are password-protected with the standard password.  If you don't know it, look at the "about" page of this website.

Click here to return to the main page.