Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
SilentBuilder is a campaign that is being used to launch bankers such as Emotet to increase the Epoch5 botnet as well as the usual tasks of this malware.
9 distinct techniques documented for this family, organized by ATT&CK tactic.
The attacker will access our system after a phishing email, more specifically SpearPhishing [T1566.002], as it will contain an attachment such as an XLS or DOCX
it contains interesting functions that will run automatically when opened
the document will contain macros or hidden functions, it will download a file, usually a dll
we can see that it contains interesting functions that will run automatically when opened
we found all the functions obfuscated and disordered. In one of the sheets, we find the most important function, which would deobfuscate most of the functionality
once downloaded it will be launched on the computer abusing Regsvr32.exe
it does have internally pages with characteristic names and that they were hidden
the dll will try to contact a list of C&C servers
it will download a file, usually a dll, once downloaded it will be launched on the computer
50 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.