Extracted

Extracted

Extracted

• • Target

    f26a443ac89f9b418959ed6f59163358f57a469af9a4509ca82bfec3e6d092b0

  • Size

    37KB

  • MD5

    b85066e6d286499120d91f942f43d371

  • SHA1

    1cfc720d33149fb6e1600144c701b057edc7c38c

  • SHA256

    f26a443ac89f9b418959ed6f59163358f57a469af9a4509ca82bfec3e6d092b0

  • SHA512

    9c676cc214ebfb50326858fc91ebae9811a4b2d3924f742d87eb0274766bdc8c1e4e8d394d3cdea7e6fcdaab2ce0c61d0a8f040c3026541a319755f2bc777f61

  Score

  10^/10

  emotetepoch4bankersuricatatrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)

    suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)

    suricata

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2