2018-11-16 - EMOTET NOW USING XML FILES AS WORD DOCS

NOTICE:


Shown above:  The new Emotet infection chain.

 

NOTES:

 

EXAMPLES OF NEW EMOTET XML ATTACHMENTS:

 

EMOTET INFECTION TRAFFIC AND MALWARE:

  • 2018-11-16-Emotet-infection-with-IcedID-and-AZORult.pcap   (9,916,890 bytes)
  • 2018-11-16-Emotet-malware-binary.exe   (1,212,416 bytes)
  • 2018-11-16-IcedID-persistent-on-infected-Windows-host.exe   (376,832 bytes)
  • 2018-11-16-IcedID-retrieved-by-Emotet-infected-host.exe   (376,832 bytes)

 

MALWARE

SHA256 HASHES FOR 8 EXAMPLES OF THE ATTACHED XML DOCUMENTS:

 

SHA256 HASHES FOR THE 2018-11-16 INFECTION (WHERE I DOWNLOADED AN EMOTET EXE DIRECTLY):

 

IMAGES


Shown above:  The new Emotet XML docs still work the same way with a macro.

 

Click here to return to the main page.