• Sublime Core Feed
High Severity

Attachment: Emotet heavily padded doc in zip file

Labels

Malware/Ransomware
Evasion
Archive analysis
Content analysis
Exif analysis
File analysis
Sender analysis

Description

Detects a potential Emotet delivery method using padded .doc files that compress into small zip files. Contents may include Red Dawn templates exceeding 500MB.

References

Sublime Security
Created Aug 17th, 2023 • Last updated Oct 4th, 2023
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and any(attachments,
        .file_extension == "zip"
        and any(file.explode(.),
                .depth == 0
                and .size < 1000000
                and not .depth > 0
                and strings.ends_with(.scan.exiftool.zip_file_name, ".doc")
                and .scan.exiftool.zip_uncompressed_size > 500000000
        )
)
and (
  profile.by_sender().prevalence in ("new", "outlier")
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_false_positives
  )
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started