Emotet 16-19/11/2019

#Emotet 16-19/11/2019

:: Resume ::
 4 Documents
66/2296 Payloads
63 C2
16 Ports
 4 Keys




[+] Documents
                +------------+--------+-----------------------------+---------------------------------------------------------+----------------------------------+
                | DATE       | epoch  | FileType                    | OriginalName                                            | MD5                              |
                +------------+--------+-----------------------------+---------------------------------------------------------+----------------------------------+
                | 2019-11-16 | epoch1 | Word 97-2003 Document [DOC] | 42637884-BZ-20190417.doc                                | 967b1e3575ffbd4818c086fa7b7b1351 |
                | 2019-11-17 | epoch2 | Word 97-2003 Document [DOC] | DOC_692160776304US_May_30_2019.doc                      | 02aa27aa2320e5305233246bb54eeafd |
                | 2019-11-17 | epoch2 | JavaScript [JS]             | INC_1354579570US_May_09_2019.zip                        | 3ada2489b28a6c0db54c0e6207227de5 |
                | 2019-11-19 | epoch2 | Word 97-2003 Document [DOC] | KYQ_47LXU7019B7ZB_JY.doc                                | 2e9bb39d8a2e60665e9d607206853912 |
                +------------+--------+-----------------------------+---------------------------------------------------------+----------------------------------+


        [-]     Stats
                +------------+--------+--------+--------+
                | DATE       | epoch1 | epoch2 | epoch3 |
                +------------+--------+--------+--------+
                | 2019-11-16 |      1 |      0 |      0 |
                | 2019-11-17 |      0 |      2 |      0 |
                | 2019-11-19 |      0 |      1 |      0 |
                +------------+--------+--------+--------+


        [-]     Metadata
                +----------------------------------+-------+---------------+---------------+-------+------------+-------+------------+------+------------------------------------+-------------------+---------------+-----------------+----------------+---------------------+---------------------+
                | MD5                              | Title | Author        | TotalEditTime | Words | Characters | Pages | ParagraphS | Line | CodePage                           | Company           | TotalEditTime | Subject         | LastModifiedBy | CreateDate          | ModifyDate          |
                +----------------------------------+-------+---------------+---------------+-------+------------+-------+------------+------+------------------------------------+-------------------+---------------+-----------------+----------------+---------------------+---------------------+
                | 2e9bb39d8a2e60665e9d607206853912 | XSS   | Julio Quitzon | 0             | 30    | 173        | 1     | 1          | 1    | Windows Latin 1 (Western European) | Greenfelder Group | 0             | Enterprise-wide | Felipa Fadel   | 2019:10:11 20:31:00 | 2019:10:11 20:31:00 |
                | 967b1e3575ffbd4818c086fa7b7b1351 |       |               | 0             | 1     | 8          | 1     | 1          | 1    | Windows Latin 1 (Western European) |                   | 0             |                 |                | 2019:04:17 07:57:00 | 2019:04:17 07:57:00 |
                +----------------------------------+-------+---------------+---------------+-------+------------+-------+------------+------+------------------------------------+-------------------+---------------+-----------------+----------------+---------------------+---------------------+




[+] Payloads
                +------------+--------+---------------------------+----------------------------------+
                | DATE       | epoch  | OriginalName              | MD5                              |
                +------------+--------+---------------------------+----------------------------------+
                | 2019-11-16 | epoch1 | 820l6o.exe                | 98292ead4d99d7ea433b0a0660ceb2f0 |
                | 2019-11-16 | epoch2 | UV8nOknW7NT9VXq0U.exe     | 080998509167dd7347f9f42164292bda |
                | 2019-11-16 | epoch3 | pacdj_9.exe               | 42b9d14a1031a5f56519e9e567245d2b |
                | 2019-11-16 | epoch2 | GamLun9eIyZMKe.exe        | 6bb5aff3bf5952cbbfd876e90e3763c3 |
                | 2019-11-16 | epoch3 | jqem_44036.exe            | 612e5f35d6ae93dffab6a40b1f0e9715 |
                | 2019-11-16 | epoch1 | rpa6vr79i3.exe            | a3c7509e6cee445bad74812150459d31 |
                | 2019-11-16 | epoch1 | qc8cvdothcau0.exe         | 306ae865f736c1b62cd1861b71b625c9 |
                | 2019-11-16 | epoch1 | qc8cvdothcau0.exe         | ad27967b241a26ffb1c0b6d9e6957edc |
                | 2019-11-16 | epoch1 | qc8cvdothcau0.exe         | 79f1510c11e2f6a360df2ebfa72d97d6 |
                | 2019-11-16 | epoch1 | qc8cvdothcau0.exe         | 5f084d5966a91d78e8ff677df210e9e0 |
                | 2019-11-16 | epoch1 | qc8cvdothcau0.exe         | 3f236ab7b8c8c6fb930015123f03cb40 |
                | 2019-11-17 | epoch1 | qc8cvdothcau0.exe         | b586f78a86052b666ec3cdc6c589c733 |
                | 2019-11-17 | epoch1 | qc8cvdothcau0.exe         | 8659830c38dad05622ce1567f388b0ea |
                | 2019-11-17 | epoch2 | HyPDU.exe                 | 077f1cc3b1df0ea574ac3b100a282fbc |
                | 2019-11-17 | epoch2 | kvttkawywr_2799013447.exe | 8f938f8a7837be788448accaa670a5a8 |
                | 2019-11-17 | epoch2 | kvttkawywr_2799013447.exe | c668e12b3aa3b0e617256840c35791c0 |
                | 2019-11-17 | epoch1 | oiw64bfbna.exe            | 3bba5d9314460fd7bc9cf825ac075182 |
                | 2019-11-17 | epoch1 | 00cfkc41un.exe            | 8101b732fe984a8ba9327946a5218fbd |
                | 2019-11-17 | epoch1 | 00cfkc41un.exe            | 46fc47551a00cc294eb5793887b48c01 |
                | 2019-11-18 | epoch2 | HyPDU.exe                 | bde64f2a6b184141e330a32ae44c1b08 |
                | 2019-11-18 | epoch1 | higttvyba1.exe            | cf848bb9e186807f68c5e53e9169e77e |
                | 2019-11-18 | epoch2 | HxrP4rSscyIMYzvRVlhJ.exe  | 589460af42d57b7357acc7470c700e8d |
                | 2019-11-18 | epoch2 | VnNmoHIlJgLneLFd3.exe     | 7f14f807c822597a8eaccfe1486a36f1 |
                | 2019-11-18 | epoch3 | r3imp3o_847.exe           | 4a54335a3b4410fd32b1e7cfbb0d43da |
                | 2019-11-18 | epoch3 | fljrn6y_4382.exe          | 7ed6472b17fe2c1b9357e1667f12ccf4 |
                | 2019-11-18 | epoch2 | etC9DB.exe                | d40358d700f1fc806e2f46448af0bca3 |
                | 2019-11-18 | epoch3 | 1j12l_5999888053.exe      | df4ff52f8a6e04e8563a9f0098cc2a8f |
                | 2019-11-18 | epoch1 | 0v0a2gik5sptv.exe         | f6caf7575dc20a9b4b06b24eddfaefd0 |
                | 2019-11-18 | epoch3 | qceqm5_0013654.exe        | b50dc6f5d62f43f0ebe7a8bdc394732c |
                | 2019-11-18 | epoch1 | yulym.exe                 | 199858f6467d1dc4c56b7aa83caa7ad8 |
                | 2019-11-18 | epoch2 | 2B6hecGxezbXRvOTwre1.exe  | b7ca24f9d9d5545c2af8698425fbfb9f |
                | 2019-11-18 | epoch3 | f4e9_513761347.exe        | c3a7eb61d01614e81ba86334bd10ce1e |
                | 2019-11-18 | epoch2 | Ss5omIc.exe               | 73550a997c598936323b80b6167378a6 |
                | 2019-11-18 | epoch1 | uyjn6.exe                 | f7379dd5d814743774776d9418a0877c |
                | 2019-11-18 | epoch3 | 97j_48847.exe             | c528d4a8e89b8006d6e77a70d107a05b |
                | 2019-11-18 | epoch2 | c.exe                     | 92d1aff2e745167b36137ba7be8712c3 |
                | 2019-11-18 | epoch3 | jpg_9.exe                 | c8163f8445e4b7d5715422720a747e14 |
                | 2019-11-18 | epoch1 | 8j95mbztta2j.exe          | 2a5229c63f5373e805c8389cdc8af7a9 |
                | 2019-11-18 | epoch2 | jj5H5lhCcGoIvV3KAU.exe    | 53353302e7d0e14a40f16c28ba0dff86 |
                | 2019-11-18 | epoch1 | s96d5g0g0o.exe            | 5576de24993a9fd1163ea03d0cf022b3 |
                | 2019-11-18 | epoch2 | 6gRLbU.exe                | 61d49ae85cc06411fb4aadb306064d1c |
                | 2019-11-18 | epoch3 | wb7pog_6355876.exe        | c65aa941758b4ecdb67894af504347b4 |
                | 2019-11-18 | epoch1 | gmz4qw.exe                | 857fc3ce9c7afead78c3b3706ceaf8af |
                | 2019-11-18 | epoch2 | 4TD5xn.exe                | 1abd0abda3cd0e67331b2464e429073a |
                | 2019-11-18 | epoch3 | 0htjne01_177.exe          | e2b981be481acd99b9b0986d42e0a47c |
                | 2019-11-19 | epoch1 | dnnai7vmng0.exe           | 15d19e6808575852957aad5e94236ffc |
                | 2019-11-19 | epoch2 | C0nMM4i.exe               | df9b448e3c1655a7c763dfbfcd2aa2d7 |
                | 2019-11-19 | epoch3 | oplbq_21.exe              | 9f4ed8b9a3f5fba63fd630dd79481ca7 |
                | 2019-11-19 | epoch2 | 2r4kefz_1.exe             | d380b0527f229dd0ccfd753c9ee3cde1 |
                | 2019-11-19 | epoch1 | ket80nf6x2w7qbf.exe       | a250384ec9c510dbf0b53d5c1a2a421e |
                | 2019-11-19 | epoch2 | ZZU6.exe                  | 125723313d50eafc05ae17ddba625057 |
                | 2019-11-19 | epoch3 | nwc2gphxo_72081824.exe    | 16912f2830cc517476488167c95928ea |
                | 2019-11-19 | epoch1 | ljqa1tbmec0san.exe        | 5c722345e39502088a0d98f52b803c90 |
                | 2019-11-19 | epoch1 | ljqa1tbmec0san.exe        | 00c8c125c757db14ed1c289801df9279 |
                | 2019-11-19 | epoch1 | reobzl.exe                | 4b0eaf8cc44eeb471aa25a0841d8d59f |
                | 2019-11-19 | epoch2 | NfZCjBEChNl77vSD2szI.exe  | 4f69a1cd4a01a046d85ae55448cf8ce8 |
                | 2019-11-19 | epoch3 | dgdl7jksgb_3494532.exe    | edfb81037957df8d4fc8a13563fb79ae |
                | 2019-11-19 | epoch2 | G2blhDNI6VbHY1xO.exe      | be72fa3a66c1add6bb0e392882e2ba09 |
                | 2019-11-19 | epoch1 | utff769.exe               | 49a6200e4f22a1830d86097eee3bd68d |
                | 2019-11-19 | epoch1 | 177pis56.exe              | f6a319db87130e2be682deef41037bf4 |
                | 2019-11-19 | epoch2 | XuETBWqWqfwZGl.exe        | 60d88acc3f529c55abb3887a23adc8aa |
                | 2019-11-19 | epoch3 | 2c2r5_144.exe             | 02cf5a4ec5b4f488e2dc26f2067c263b |
                | 2019-11-19 | epoch1 | sc2vqzz9rajg.exe          | 7279b83f81a915424b1b3803c485cb0e |
                | 2019-11-19 | epoch2 | ot7DNgENeKjjz2L.exe       | 93f82254b00a4f1ff13b6a4987bf7bb0 |
                | 2019-11-19 | epoch3 | jd4aff_6455.exe           | d21d22de3c438c7763f14be86b044279 |
                | 2019-11-19 | epoch1 | n39g5869.exe              | a170542c749bfb18cd211e8dc0bee679 |
                +------------+--------+---------------------------+----------------------------------+


        [-]     Stats
                +------------+--------+--------+--------+
                | DATE       | epoch1 | epoch2 | epoch3 |
                +------------+--------+--------+--------+
                | 2019-11-16 |    128 |    109 |    108 |
                | 2019-11-17 |      6 |      3 |      0 |
                | 2019-11-18 |    282 |    290 |    287 |
                | 2019-11-19 |    372 |    369 |    367 |
                +------------+--------+--------+--------+


        [-]     MetaData
                +--------------+-----------------+--------------+-------------------------+
                | CompanyName  | FileDescription | InternalName | ProductName             |
                +--------------+-----------------+--------------+-------------------------+
                |              |                 |              |                         |
                | theblackhand | BitmapCase      | BitmapCase   | theblackhand BitmapCase |
                +--------------+-----------------+--------------+-------------------------+




[+] Ports
        [-]     By Epoch
                +------------+--------+------------------------------------------------------+
                | DATE       | epoch  | PORTS                                                |
                +------------+--------+------------------------------------------------------+
                | 2019-11-16 | epoch1 | 443, 7080, 80, 8080, 8090, 990, 995                  |
                | 2019-11-16 | epoch2 | 20, 21, 443, 465, 7080, 80, 8080, 8090               |
                | 2019-11-16 | epoch3 | 20, 443, 50000, 7080, 80, 8080, 8081, 8090, 990, 993 |
                | 2019-11-18 | epoch1 | 443, 50000, 7080, 80, 8080, 8090, 990, 995           |
                | 2019-11-19 | epoch2 | 20, 21, 22, 443, 465, 50000, 7080, 80, 8080, 8090    |
                | 2019-11-19 | epoch3 | 443, 50000, 7080, 80, 8080, 8081, 990, 993           |
                | 2019-11-19 | epoch1 | 143, 20, 22, 443, 50000, 7080, 80, 8080, 8443, 990   |
                +------------+--------+------------------------------------------------------+

        [-]     Ports
				143 | 20 | 21 | 22 | 443 | 465 | 50000 | 7080 | 80 | 8080 | 8081 | 8090 | 8443 | 990 | 993 | 995




[+] RSA Keys
        [-]     By Epoch
                ******************************************************
                  epoch: epoch1
                RSA_KEY:
                -----BEGIN PUBLIC KEY-----
                MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAOmlscqbEIhLjVsj9r3eYacKi6C+Qrua
                j5TlU+pn3zc0k06qCoahFXBBGnYMotHQc6OwfBKwHWm831LIVg29kEjT8UYxnN5v
                fzNGgqXTe25QARf78CsQqqN/ImKdXo+GFwIDAQAB
                -----END PUBLIC KEY-----
                ******************************************************
                  epoch: epoch1
                RSA_KEY:
                -----BEGIN PUBLIC KEY-----
                MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAOzoTryw1r9RxRJPFKalO4+q7JaDZWSB
                KZlEc22H6ITuE06tvJspue42TF1yk8xN+1bqW++QeV6Clm1uRswA/qoao/6p4eN0
                h4zIO8PEaJ0C/9EO4cx9yfRLlVpjdEkP0QIDAQAB
                -----END PUBLIC KEY-----
                ******************************************************
                  epoch: epoch2
                RSA_KEY:
                -----BEGIN PUBLIC KEY-----
                MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAKl4M80uy0jcxUiFIaJJyxgHVVnFtCq6
                bi6f2xXPh/XUZNyN8UXDe5HzhTc4kwon9MBZffNwFOIc61QfV3K3YzEI/ktcyNqK
                LS67ONxsVep769QdiVQJXrIaFjMXKz6viwIDAQAB
                -----END PUBLIC KEY-----
                ******************************************************
                  epoch: epoch3
                RSA_KEY:
                -----BEGIN PUBLIC KEY-----
                MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAMqZMACZDzcRXuSnj2OI8LeIYKrbUIXL
                faUgIJPwYd305HnaBS2AfA0R+oPxT32r+3BbayI3KguqAn3E+rbwtLhqhOXOlTnY
                7yvG4ufmwCCkRzc6Sq8baToxmd6y523AIQIDAQAB
                -----END PUBLIC KEY-----