Emotet’s Uncommon Approach of Masking IP Addresses

McAfee researchers analyzed an Emotet maldoc campaign that uses hexadecimal and octal representations of IP addresses to obfuscate URLs and evade detection; the infection chain is phishing Excel attachment → mshta executing obfuscated JavaScript → PowerShell downloading a DLL (saved as C:\Users\Public\Documents\ssd.dll) → DLL executed by rundll32 establishing C2. The report includes sample command lines, file and URL IOCs, hashes for the XLS and DLL, and MITRE ATT&CK technique mappings.