Extracted

• • Target

    46b946af8522c3a64a33b4daf6f6a3bb1043b24fd8adc2b72fe6641451082a0c.xls

  • Size

    217KB

  • MD5

    19b553ceebbec2c2420250ab98b95a70

  • SHA1

    08be0cb31f0b3646dcf372e79d796089285ead0f

  • SHA256

    46b946af8522c3a64a33b4daf6f6a3bb1043b24fd8adc2b72fe6641451082a0c

  • SHA512

    9b1e0881e9b20e54fb1680c0ac306a8cb66d4b92d1718f29982beea459bd5363aa9461ec30bb5f93d1279050fdcab00b1309763b4055208495b108d11d219b9b

  • SSDEEP

    6144:OKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgIyY+TAQXTHGUMEyP5p6f5jQm3:bbGUMVWlb3

  Score

  10^/10

  emotetbankerpersistencetrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2