← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
Emotet Strikes Again - LNK File Leads to Domain Wide Ransomware - The DFIR Report
WHITE OtpNgGim 2022-11-29 Modified: 2022-12-29
50
IOCs
MEDIUM VOLUME
cobalt strikeemotetet cncfeodo trackercnc servertactical rmmdfir reportanydesklnk filerclonepowershellagentbumblebeeexecutionlsassimpactjunecovenantmetasploitempireposhc2persistencemimikatzmegadatemeterpretertwitter
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
Indicators of Compromise (8 / 50 total)
All URL FileHash-MD5 FileHash-SHA1 FileHash-SHA256 YARA domain hostname
TYPEINDICATORDESCRIPTIONCREATED
FileHash-MD5 0ea68856c4f56f4056502208e97e9033 — 2022-11-29
FileHash-MD5 211897664d51cffdfd7f78d684602ecc — 2022-11-29
FileHash-MD5 22bbe1747933531e9c240e0db86268e2 MD5 of c2a8776e21403eb00b38bfccd36d1c03dffb009e 2022-11-29
FileHash-MD5 27f7186499bc8d10e51d17d3d6697bc5 MD5 of 52332ce16ee0c393b8eea6e71863ad41e3caeafd 2022-11-29
FileHash-MD5 50cc3a3bca96d7096c8118e838d9bc16 MD5 of b286b58ed32b6df4ecdb5df86d7d7d177bb7bfaf 2022-11-29
FileHash-MD5 a0e9f5d64349fb13191bc781f81f42e1 — 2022-11-29
FileHash-MD5 d2df4601c8d43e655163c0b292bc4cc9 — 2022-11-29
FileHash-MD5 de7c4da78a6cbba096e32e5eecb00566 MD5 of 02b4f495e9995cc2251c19cd9984763f52122951 2022-11-29
References (1)
↗ https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/