Extracted

• • Target

    XDK 002732.lnk

  • Size

    2KB

  • MD5

    dec2778e7c82c4c7d79e9dafd5974a50

  • SHA1

    a2b1ea6a77f86435a2f5298fc06a3ed139dc404b

  • SHA256

    4f49ad2d17845e9efc8ab9b205c88548de505324e1ee7b3ffb94996c8f13dde3

  • SHA512

    6fd7b9bd3c928620ab6e414d2a1a3aeafe56aa329233df9a2e914446e7c54bb98a3bd73d2534b4aab7aff28a02574d6c41ef750aa8b1b1281e2820ee8ed7e133

  Score

  10^/10

  emotetepoch5bankersuricatatrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • An obfuscated cmd.exe command-line is typically used to evade detection.

  behavioral1behavioral2