← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
Emansrepo Stealer: Multi-Vector Attack Chains | FortiGuard Labs
WHITE tr2222200 2024-09-09 Modified: 2024-10-09
69
IOCs
HIGH VOLUME
A multi-Vector attack campaign that steals data from victims via email has been observed by FortiGuard Labs, a security firm, and is currently being investigated by the US National Security Agency (NSA).
infostealersecurity attackfortiguard labs threat researchdasmakefortinetemansreponovemberfortiguardfortigatefortimailforticlientfortiedrfortiguard cdrserviceteammalwareprysmaxremcos
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
MALWARE FAMILIES
Emansrepo Prysmax Remcos
Indicators of Compromise (69)
All URL hostname domain FileHash-MD5 FileHash-SHA1 FileHash-SHA256
TYPEINDICATORDESCRIPTIONCREATED
URL https://bafybeifhhbimsau6a6x4m2ghdmzer5c3ixfztpocqqudlo4oyzer224q4y.ipfs.w3s.link/myscr649612.js — 2024-09-09
hostname bafybeifhhbimsau6a6x4m2ghdmzer5c3ixfztpocqqudlo4oyzer224q4y.ipfs.w3s.link — 2024-09-09
URL https://bafybeigm3wrvmyw5de667rzdgdnct2fvwumyf6zyzybzh3tqvv5jhlx2ta.ipfs.dweb.link/wetrankfr.zip — 2024-09-09
URL https://dasmake.top/reader/timer.php — 2024-09-09
URL https://estanciaferreira.com.br/wp-includes/TIANJIN-DOC-05082024-xls.7z — 2024-09-09
URL https://hedam.shop/simple/Enquiry.7z 8e8ccb3fbbba0729b55a7a52c237187267576fad2f717f1e02a4b5ac18dee0c8 2024-09-09
domain dasmake.top — 2024-09-09
domain estanciaferreira.com.br — 2024-09-09
domain hedam.shop — 2024-09-09
hostname bafybeigm3wrvmyw5de667rzdgdnct2fvwumyf6zyzybzh3tqvv5jhlx2ta.ipfs.dweb.link — 2024-09-09
FileHash-MD5 0309da3cfb9ec5b614ee9228357e58f2 MD5 of 32bcbce53bfee33112b447340e7114d6d46be4ccf1a5391ad685431afdc8fb86 2024-09-09
FileHash-MD5 1720142bbec3a3e7848069c357219a2c MD5 of 6670e5c7521966e82d091e7adff4e16335f03f2e2740b653adcc9bfe35c7bf9b 2024-09-09
FileHash-MD5 18f3e097b43b443a82959add15c5a8d0 MD5 of b343cce5381b8633b3fd3da56698f60db70c75422e120235a00517d519e37d8d 2024-09-09
FileHash-MD5 4243f1f4305a46628486013aacb4f119 MD5 of bee8da411e71547ac765a5e63e177b59582df438432cc3b540b57a6f1a56dd16 2024-09-09
FileHash-MD5 42b138bfa08e128807d571acc42130a6 MD5 of 915bad0e2dbe0a18423c046f84d0ff7232fff4e5ba255cc710783f6e4929ab32 2024-09-09
FileHash-MD5 5107c1ff144fc36e00014e04917d113f MD5 of 222dd76c461e70c3cb330bacfcf465751b07331c4f8a4415c09f4cd7c4e6fcd9 2024-09-09
FileHash-MD5 52a5dc40d2942d6776a15366797ac5a6 MD5 of ae2a5a02d0ef173b1d38a26c5a88b796f4ee2e8f36ee00931c468cd496fb2b5a 2024-09-09
FileHash-MD5 5737683c12a5d76fd8aefeeebc2e4eb5 MD5 of 70ba3d67b476e98419ecbbbb5d81efcb5a07f55a92c96e7b9207176746e3b7a6 2024-09-09
FileHash-MD5 58575fcd368fa0236157a1752c86e5b2 MD5 of 9e5580d7c3c22e37b589ec8eea2dae423c8e63f8f666c83edabecf70a0948b99 2024-09-09
FileHash-MD5 69c635bd8e4bea13cb4481f6f75d01d6 MD5 of a6c2df5df1253f50bd49e7083fef6cdac544d97db4a6c9c30d7852c4fd651921 2024-09-09
FileHash-MD5 7ab52fad42dad989eda040f20e476245 MD5 of 9bd3b8d9ac6ad680b0d0e39b82a439feedd87b9af580f37fa3d80d2c252fef8c 2024-09-09
FileHash-MD5 7e624d04567390e409c27ac1203d7e65 MD5 of 8e43c97e5bc62211b3673dee13e376a1f5026502ebe9fd9f7f455dc17c253b7f 2024-09-09
FileHash-MD5 94ebcda891d70f117249d025c829fc2b MD5 of 18459be33cd4f59081098435a0fbaa649f301f985647a75d21b7fc337378e59b 2024-09-09
FileHash-MD5 9bb61d7adc85b2b6e2996f6166059562 MD5 of 9866934dd2b4e411cdabaa7a96a63f153921a6489f01b0b40d7febed48b02c22 2024-09-09
FileHash-MD5 ab10d2d206057b147619064f84c58654 MD5 of 64e5c9e7b8dfb8ca8ca73895aa51e585fa7e5414f0e1d10659d3a83b9f770333 2024-09-09
FileHash-MD5 b18375f25620f14e0964afb6751bcc79 MD5 of a2fa6790035c7af64146158f1ed20cb54f4589783e1f260a5d8e4f30b81df70d 2024-09-09
FileHash-MD5 b443897756c11f5006f022077b1d74f2 MD5 of dd656953a6844dd9585f05545a513c4e8c2ded13e06cdb67a0e58eda7575a7a4 2024-09-09
FileHash-MD5 c41e68d28b8c61dcee5fec5010c1e637 MD5 of 4cd8c9fa7f5e2484b73ed9c7be55aa859969c3f21ca2834610102231d337841d 2024-09-09
FileHash-MD5 d81d03125d103b2d7e0962234a84fb2c MD5 of e346f6b36569d7b8c52a55403a6b78ae0ed15c0aaae4011490404bdb04ff28e5 2024-09-09
FileHash-SHA1 125837212a329aab8685803f20244783cb9ffa88 SHA1 of 9866934dd2b4e411cdabaa7a96a63f153921a6489f01b0b40d7febed48b02c22 2024-09-09
FileHash-SHA1 1e19d1aa6c9e7e20a73568f81bfd2fcc8685c1fc SHA1 of ae2a5a02d0ef173b1d38a26c5a88b796f4ee2e8f36ee00931c468cd496fb2b5a 2024-09-09
FileHash-SHA1 2e12fa0daa5e3e4f3c38a862936cf7f03a774edf SHA1 of 9e5580d7c3c22e37b589ec8eea2dae423c8e63f8f666c83edabecf70a0948b99 2024-09-09
FileHash-SHA1 45f9218a745ed83a7f382d89ebea1f71d4902e07 SHA1 of 18459be33cd4f59081098435a0fbaa649f301f985647a75d21b7fc337378e59b 2024-09-09
FileHash-SHA1 5233f3f48d27c78a5cc92c2ca95a6233232a4bfe SHA1 of a6c2df5df1253f50bd49e7083fef6cdac544d97db4a6c9c30d7852c4fd651921 2024-09-09
FileHash-SHA1 563230e1b8b7a7f014e1f8cd0130b74e5327bf4e SHA1 of 64e5c9e7b8dfb8ca8ca73895aa51e585fa7e5414f0e1d10659d3a83b9f770333 2024-09-09
FileHash-SHA1 5c4c26fc200a8b5b97a9dc90fdec64197606b841 SHA1 of 9bd3b8d9ac6ad680b0d0e39b82a439feedd87b9af580f37fa3d80d2c252fef8c 2024-09-09
FileHash-SHA1 65dbab4b3dcb2de2dbdf15d35e063441d3355f7f SHA1 of a2fa6790035c7af64146158f1ed20cb54f4589783e1f260a5d8e4f30b81df70d 2024-09-09
FileHash-SHA1 672f4f88c1678dd89001e54be1ada8f3ea38215f SHA1 of 222dd76c461e70c3cb330bacfcf465751b07331c4f8a4415c09f4cd7c4e6fcd9 2024-09-09
FileHash-SHA1 81135acf8368ee9a6e59f94dcbf71ca327359bdb SHA1 of e346f6b36569d7b8c52a55403a6b78ae0ed15c0aaae4011490404bdb04ff28e5 2024-09-09
FileHash-SHA1 8617126ceb3329213c6e35f931ecf2398812ede1 SHA1 of 4cd8c9fa7f5e2484b73ed9c7be55aa859969c3f21ca2834610102231d337841d 2024-09-09
FileHash-SHA1 8e467dfee03942f3924e7123e4b1dbb574da5ae0 SHA1 of 6670e5c7521966e82d091e7adff4e16335f03f2e2740b653adcc9bfe35c7bf9b 2024-09-09
FileHash-SHA1 960dd8a8245a7cd869d39bd3d7b31a762b2dafda SHA1 of dd656953a6844dd9585f05545a513c4e8c2ded13e06cdb67a0e58eda7575a7a4 2024-09-09
FileHash-SHA1 9856a70d1a1ba47e97f24e0664a2e0add0998ffb SHA1 of 70ba3d67b476e98419ecbbbb5d81efcb5a07f55a92c96e7b9207176746e3b7a6 2024-09-09
FileHash-SHA1 abdaf212f2bd066618f3432c6fefc593948d7d12 SHA1 of 32bcbce53bfee33112b447340e7114d6d46be4ccf1a5391ad685431afdc8fb86 2024-09-09
FileHash-SHA1 dc5098799db7f5058797cfd09bfb0a3060c08655 SHA1 of b343cce5381b8633b3fd3da56698f60db70c75422e120235a00517d519e37d8d 2024-09-09
FileHash-SHA1 e40d4698a04faed223e6a98cc066ccb24381ad1a SHA1 of bee8da411e71547ac765a5e63e177b59582df438432cc3b540b57a6f1a56dd16 2024-09-09
FileHash-SHA1 ea4e515e003438d68d51f1d27971d3ca8330a651 SHA1 of 8e43c97e5bc62211b3673dee13e376a1f5026502ebe9fd9f7f455dc17c253b7f 2024-09-09
FileHash-SHA1 f4d317a32146d1057b9df27d15283db88bf5d886 SHA1 of 915bad0e2dbe0a18423c046f84d0ff7232fff4e5ba255cc710783f6e4929ab32 2024-09-09
FileHash-SHA256 18459be33cd4f59081098435a0fbaa649f301f985647a75d21b7fc337378e59b — 2024-09-09
FileHash-SHA256 222dd76c461e70c3cb330bacfcf465751b07331c4f8a4415c09f4cd7c4e6fcd9 — 2024-09-09
FileHash-SHA256 32bcbce53bfee33112b447340e7114d6d46be4ccf1a5391ad685431afdc8fb86 — 2024-09-09
FileHash-SHA256 4cd8c9fa7f5e2484b73ed9c7be55aa859969c3f21ca2834610102231d337841d — 2024-09-09
FileHash-SHA256 64e5c9e7b8dfb8ca8ca73895aa51e585fa7e5414f0e1d10659d3a83b9f770333 — 2024-09-09
FileHash-SHA256 6670e5c7521966e82d091e7adff4e16335f03f2e2740b653adcc9bfe35c7bf9b — 2024-09-09
FileHash-SHA256 6e7313b6aa37a00b602e620a25a0b71a74503ea967f1814c6c7b8b192535a043 — 2024-09-09
FileHash-SHA256 70ba3d67b476e98419ecbbbb5d81efcb5a07f55a92c96e7b9207176746e3b7a6 — 2024-09-09
FileHash-SHA256 7a9826be22b6d977d6a0e5179f84d8e88b279fe6d9df8f6c93ebc40a6ba70f06 — 2024-09-09
FileHash-SHA256 8e43c97e5bc62211b3673dee13e376a1f5026502ebe9fd9f7f455dc17c253b7f — 2024-09-09
FileHash-SHA256 915bad0e2dbe0a18423c046f84d0ff7232fff4e5ba255cc710783f6e4929ab32 — 2024-09-09
FileHash-SHA256 9866934dd2b4e411cdabaa7a96a63f153921a6489f01b0b40d7febed48b02c22 — 2024-09-09
FileHash-SHA256 9bd3b8d9ac6ad680b0d0e39b82a439feedd87b9af580f37fa3d80d2c252fef8c — 2024-09-09
FileHash-SHA256 9e5580d7c3c22e37b589ec8eea2dae423c8e63f8f666c83edabecf70a0948b99 — 2024-09-09
FileHash-SHA256 a2fa6790035c7af64146158f1ed20cb54f4589783e1f260a5d8e4f30b81df70d — 2024-09-09
FileHash-SHA256 a6c2df5df1253f50bd49e7083fef6cdac544d97db4a6c9c30d7852c4fd651921 — 2024-09-09
FileHash-SHA256 ae2a5a02d0ef173b1d38a26c5a88b796f4ee2e8f36ee00931c468cd496fb2b5a — 2024-09-09
FileHash-SHA256 b343cce5381b8633b3fd3da56698f60db70c75422e120235a00517d519e37d8d — 2024-09-09
FileHash-SHA256 bee8da411e71547ac765a5e63e177b59582df438432cc3b540b57a6f1a56dd16 — 2024-09-09
FileHash-SHA256 dd656953a6844dd9585f05545a513c4e8c2ded13e06cdb67a0e58eda7575a7a4 — 2024-09-09
FileHash-SHA256 e346f6b36569d7b8c52a55403a6b78ae0ed15c0aaae4011490404bdb04ff28e5 — 2024-09-09
References (1)
↗ https://www.fortinet.com/blog/threat-research/emansrepo-stealer-multi-vector-attack-chains