【図表】
Image of Infection map for EMOTET Maldoc as observed by McAfee [マカフィーが観測したEMOTET Maldocの感染マップのイメージ。]
Image of the initial worksheet opened in excel [エクセルで開いた最初のワークシートの画像]
Named Manager and Auto_Open triggers [Named ManagerとAuto_Openのトリガー]
出典: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/emotets-uncommon-approach-of-masking-ip-addresses/
【ブログ】
◆Emotet’s Uncommon Approach of Masking IP Addresses (McAfee, 2022/02/04)
[EmotetのIPアドレスのマスキングという常識破りな取り組み]
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/emotets-uncommon-approach-of-masking-ip-addresses/
【関連まとめ記事】
◆全体まとめ
◆マルウェア / Malware (まとめ)
◆バンキングマルウェア (まとめ)
◆復活版 Emotet (まとめ)
https://malware-log.hatenablog.com/entry/Emotet_2
【インディケータ情報】
■ハッシュ情報(Sha256) - Emotet -
06be4ce3aeae146a062b983ce21dd42b08cba908a69958729e758bc41836735c
a0538746ce241a518e3a056789ea60671f626613dd92f3caa5a95e92e65357b3
(以上は McAfee の情報: 引用元は https://www.mcafee.com/blogs/other-blogs/mcafee-labs/emotets-uncommon-approach-of-masking-ip-addresses/ )
■url情報 - -
hxxp://185.7.214.7/fer/fer.html
hxxp://46.105.81.76/c.html
hxxp://185.7.214.7/fer/fer.png
hxxp://46.105.81.76/cc.png
(以上は McAfee の情報: 引用元は https://www.mcafee.com/blogs/other-blogs/mcafee-labs/emotets-uncommon-approach-of-masking-ip-addresses/ )
【検索】
google: 06be4ce3aeae146a062b983ce21dd42b08cba908a69958729e758bc41836735c
google: a0538746ce241a518e3a056789ea60671f626613dd92f3caa5a95e92e65357b3
google: site:virustotal.com 06be4ce3aeae146a062b983ce21dd42b08cba908a69958729e758bc41836735c
google: site:virustotal.com a0538746ce241a518e3a056789ea60671f626613dd92f3caa5a95e92e65357b3
■海外検索
https://google.com/search?q=
https://google.com/search?tbm=nws&q=
【VT検索】
https://www.virustotal.com/gui/file/06be4ce3aeae146a062b983ce21dd42b08cba908a69958729e758bc41836735c
https://www.virustotal.com/gui/file/a0538746ce241a518e3a056789ea60671f626613dd92f3caa5a95e92e65357b3
https://www.virustotal.com/gui/ip-address/185.7.214.7
https://www.virustotal.com/gui/ip-address/46.105.81.76
https://www.virustotal.com/gui/ip-address/185.7.214.7
https://www.virustotal.com/gui/ip-address/46.105.81.76
