Extracted

• • Target

    de55be09f19b429d1ed4fd4cf090074177e7828dffb352fb64ce51d864a19596.xls

  • Size

    217KB

  • MD5

    de3ab2538b01e48fc287375fe8cf1e8e

  • SHA1

    b7b4492eb9105fbaab1a50d45e54be43de0ceb8e

  • SHA256

    de55be09f19b429d1ed4fd4cf090074177e7828dffb352fb64ce51d864a19596

  • SHA512

    979c8cdbdf796d0db101fbb11f68ffffa27984a3edfbee57d6bfd8a34be5dd27511acab0aede56a303c6016e55c6a0f6d125decc8899ddd3ca8807927738223c

  • SSDEEP

    6144:OKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgIyY+TAQXTHGUMEyP5p6f5jQm3:bbGUMVWlb3

  Score

  10^/10

  emotetbankerpersistencetrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2