Emotet’s Uncommon Approach of Masking IP Addresses

McAfee Blog – 2.5.22 (2.4.22)

In a recent campaign of Emotet, McAfee Researchers observed a change in techniques. The Emotet maldoc was using hexadecimal and octal formats to represent IP address which is usually represented by decimal formats. An example of this is shown below:

Source: Emotet’s Uncommon Approach of Masking IP Addresses