[Antelox]

thanks

https://www.virustotal.com/en/file/09c8 ... 530544166/

Geodo/Emotet doc downloader.

Payload: https://www.virustotal.com/en/file/4728 ... /analysis/

BR,

Antelox

[ikolor]

thanks ..

https://www.virustotal.com/en/file/1924 ... 530890838/

[r0ny]

thanks ..

https://www.virustotal.com/en/file/1924 ... 530890838/

emotet from

hxxp://www[.]anadolu-yapi.xyz/Agreements-July

C2:

hxxp://www[.]fundacionravera.com/PqhFVpWv2

[ikolor]

Thanks
Botnet what Botnet.

http://191.96.249.27/

[ynvb]

Well, much have changed since this thread was last updated ;)
Just putting this here to keep things updated, in case anyone is still reading this...

https://research.checkpoint.com/emotet- ... it-clones/

[ikolor]

hi

https://www.virustotal.com/en/file/0489 ... 533062576/

[Antelox]

hi

https://www.virustotal.com/en/file/0489 ... 533062576/

The doc downloads Geodo/Emotet.
The binary downloaded: https://www.virustotal.com/en/file/06ce ... /analysis/

BR,

Antelox

[ikolor]

Next

https://www.virustotal.com/en/file/8208 ... 183262.doc

https://www.youtube.com/watch?v=Lli99OmkPwM

[Antelox]

Next

https://www.virustotal.com/en/file/8208 ... 183262.doc

https://www.youtube.com/watch?v=Lli99OmkPwM

Geodo/Emotet doc downloader.

Binary downloaded: https://www.virustotal.com/en/file/4c8c ... /analysis/

BR,

Antelox

[ikolor]

next

https://www.virustotal.com/en/file/f31a ... DQOHKD.doc