Extracted

Extracted

Extracted

• • Target

    04cbc0b177c15fce9d0ab4d483fae95e6eee3979d6ef931066c569b1748c3908

  • Size

    114KB

  • MD5

    762dc2ad8c9f6360ee9c107028d17253

  • SHA1

    ee1dcd803cc7fe4e267e080e6f16f09983ef3d49

  • SHA256

    04cbc0b177c15fce9d0ab4d483fae95e6eee3979d6ef931066c569b1748c3908

  • SHA512

    5c4ac0430e8a5c7b3deafbd08014ce97a4b0aca115ff5d8db2479f95eb5c791fd807b520c5ed2e24f9c16501e88c6c8e8116de504b24699a9aee8239d77d90dc

  Score

  10^/10

  emotetepoch5bankersuricatatrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2