Extracted

• • Target

    92077cc2f2ca2e4e8a4c9fcc0dad72835888f9559af3b0fa37a5edb2c1b65f57.xls

  • Size

    217KB

  • MD5

    48a735235c970363e2baa2f5516699dc

  • SHA1

    0cde99b6a92fbabb3bafec3a4f5aae76a0aeca65

  • SHA256

    92077cc2f2ca2e4e8a4c9fcc0dad72835888f9559af3b0fa37a5edb2c1b65f57

  • SHA512

    a1a5251c4957179642b40152846fd0bb0ffdf85c496ec654a3d1a6c20c6099988111dd6ba173de7931e3608d3b5e31f384ce7679b6577384ca33fb9e4eeceb53

  • SSDEEP

    6144:OKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgIyY+TAQXTHGUMEyP5p6f5jQmr:bbGUMVWlbr

  Score

  10^/10

  emotetbankerpersistencetrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2