Search

http://{BLOCKED}enges.xyz/wp-admin/ebPbsOdsRJA9G/ TrojanDownloader:O97M/Emotet.BENV!MTB (MICROSOFT), Trojan.MSOffice.Emotet.gen (Kaspersky)

luring users to enable macro content: It connects to the following URLs to execute remote code: http://{BLOCKED}.{BLOCKED}.118.168/vvv/ppp/fe.html TrojanDownloader:O97M/Emotet.EXNY!MTB (MICROSOFT)

following: It contains the following message details luring users to enable macro content: TrojanDownloader:O97M/Emotet.EXNV!MTB (MICROSOFT) Downloaded from the Internet Connects to URLs/IPs, Displays

}o.net/PaginaMasVieja1321654/F1M5dBu8axuQkx0p8/ https://{BLOCKED}ahoy.com.ar/wp-content/S1nkrxCcDV89DLpTXhqC/ TrojanDownloader:O97M/Emotet.PKST!MTB (MICROSOFT)

}o.net/PaginaMasVieja1321654/F1M5dBu8axuQkx0p8/ https://{BLOCKED}ahoy.com.ar/wp-content/S1nkrxCcDV89DLpTXhqC/ TrojanDownloader:O97M/Emotet.PKST!MTB (MICROSOFT)

https://{BLOCKED}harma.com/wp-includes/KKXAiWGL/ https://{BLOCKED}ate.bb2play.com/framework/1zTlT1/ TrojanDownloader:O97M/Emotet.PKCZ!MTB (EMOTET)

component, or in a specific environment in order to proceed with its intended routine. Trojan:Win32/Raccoon.RD!MTB (MICROSOFT), UDS:Trojan-Spy.Win32.Stealer.gen (KASPERSKY) Dropped by other malware Connects to

{BLOCKED}e.com Trojan:Win32/SpyNoon.KS!MTB (MICROSOFT)

}ahasa.unsyiah.ac.id/backup/qWzXJpGddclh4zZjt http://{BLOCKED}oglu.com.tr/wp-admin/317Sz3wZsYmAAmmL6 TrojanDownloader:O97M/Emotet.PKCU!MTB (MICROSOFT)

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\ Control\SafeBoot\Network\ MSOfficerunOncelsls {Default} = Service Trojan:MSIL/Marsilia!MTB (MICROSOFT) Downloaded from the Internet, Dropped by other malware Modifies system

%2BWC71OPVNPa49QaAJadz20ZpqJ4CEEJLalPOx2YUHCpjsaUcQQQ%3D It requires being executed with a specific argument/parameter, an additional component, or in a specific environment in order to proceed with its intended routine. Trojan:Win32/Discovery!MTB

specific environment in order to proceed with its intended routine. Ransom:Win64/HiveCrypt.SU!MTB (MICROSOFT) Downloaded from the Internet, Dropped by other malware Connects to URLs/IPs

are inaccessible. TrojanDownloader:O97M/Emotet.AMTA!MTB (MICROSOFT) Downloaded from the Internet, Dropped by other malware Connects to URLs/IPs, Downloads files

}nmicrosoftline58790916773518416707967109425.skyitsl.com:8443/impact?impact={BLOCKED}d@{BLOCKED}books.com # However, as of this writing, the said sites are inaccessible. It does not exploit any vulnerability. Trojan:HTML/Phish.HNDB!MTB (MICROSOFT) Downloaded from the

It drops the following file(s) as ransom note: {Path of Encrypted File}\RECOVER YOUR FILES.txt {Path of Encrypted File}\RECOVER YOUR FILES.hta Ransom:MSIL/BlackClaw.DEA!MTB (Microsoft),

is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.) This report is generated via an automated analysis system. Trojan:Win32/Predator.BC!MTB

generated via an automated analysis system. Trojan:MSIL/AgentTesla.TQI!MTB (Microsoft); Trojan-FRAX!4EF9F94D9E82 (McAfee); HEUR:Trojan-PSW.MSIL.Agensla.gen (Kaspersky); Trojan.Win32.Generic!BT (Sunbelt)

via an automated analysis system. Trojan:Win32/DelpInj!MTB (Microsoft); Backdoor.Win32.DarkKomet.igtq (Kaspersky); Trojan.Win32.Generic!BT (Sunbelt)

analysis system. Trojan:Win32/Trickbot!MTB (Microsoft); Trojan-Dropper.Win32.Dapato.pyzd (Kaspersky); Trojan.Win32.Generic!BT (Sunbelt)

Modifications This Trojan deletes the following files: {malware file path and name} This report is generated via an automated analysis system. Trojan:Win32/Predator.BC!MTB [non_writable_container] (Microsoft);