2017-10-10 - MALSPAM PUSHING EMOTET TROJAN

ASSOCIATED FILES:

  • 2017-10-10-Emotet-malspam-traffic.pcap   (3,378,330 bytes)
  • 2017-10-10-Emotet-malspam-0630-UTC.eml   (1,080 bytes)
  • 2017-10-10-Emotet-malspam-0635-UTC.eml   (1,910 bytes)
  • 2017-10-10-Emotet-malspam-0644-UTC.eml   (2,458 bytes)
  • 2017-10-10-Emotet-malspam-0820-UTC.eml   (1,790 bytes)
  • 2017-10-10-Emotet-malspam-0824-UTC.eml   (1,853 bytes)
  • 2017-10-10-Emotet-malspam-0839-UTC.eml   (2,973 bytes)
  • 2017-10-10-Emotet-malspam-0903-UTC.eml   (1,739 bytes)
  • 2017-10-10-Emotet-malspam-0921-UTC.eml   (1,392 bytes)
  • 2017-10-10-Emotet-malspam-0952-UTC.eml   (1,748 bytes)
  • 2017-10-10-Emotet-malspam-1152-UTC.eml   (2,337 bytes)
  • 2017-10-10-Emotet-malspam-1231-UTC.eml   (1,978 bytes)
  • 2017-10-10-Emotet-malspam-1233-UTC.eml   (2,056 bytes)
  • 2017-10-10-Emotet-malspam-1301-UTC.eml   (1,334 bytes)
  • 2017-10-10-Emotet-malspam-1421-UTC.eml   (2,659 bytes)
  • 5572.exe   (105,472 bytes)
  • Purchase Order _ 5894568.doc   (81,920 bytes)
  • shedulecart.exe   (221,696 bytes)

 

TWEETS NOTED ABOUT TODAY'S WAVE OF #EMOTET MALSPAM:

 

EMAIL


Shown above:  Screenshot from an email seen on 2017-10-10.

 

COLLECTED MALSPAM:

 


Shown above:  Clickin on a link from one of the emails returns a randomly-named document.

 


Shown above:  Malicious Word document downloaded from a link in one of the emails.

 

TRAFFIC


Shown above:  Traffic from an infection filtered in Wireshark.

 


Shown above:  SMTP traffic from an infected Windows host sending more malspam.

 

URLS FROM THE EMAILS:

 

TRAFFIC FROM AN INFECTED HOST:

 

MALWARE

WORD DOCUMENT DOWNLOADED FROM EMAIL LINK:

MALWARE DOWNLOADED BY WORD MACRO:

MALWARE PERSISTENT ON THE INFECTED HOST:


Shown above:  Malware persistent on the infected Windows host.

 

FINAL NOTES

Once again, here are the associated files:

ZIP files are password-protected with the standard password.  If you don't know it, look at the "about" page of this website.

Click here to return to the main page.