Extracted

• • Target

    f6e373ce039a5cc8c40b1df8d89557ec40f5ee36f5add54efdfb81732e3d17ab.xls

  • Size

    217KB

  • MD5

    8a8e7a345463f9c84c094d99aa3f23a1

  • SHA1

    90951630600ff85cdf5ce3a0554044ddc4f9b6dd

  • SHA256

    f6e373ce039a5cc8c40b1df8d89557ec40f5ee36f5add54efdfb81732e3d17ab

  • SHA512

    d7fe557e9e5e5939eaf9ad273a8563c8a828b06c263e2248a2906cfab2b0be312988348e1115638ff6f044e3df66743709ee27fe177fa0bc4b076d90155ff240

  • SSDEEP

    6144:OKpb8rGYrMPe3q7Q0XV5xtuEsi8/dg8yY+TAQXTHGUMEyP5p6f5jQmB:nbGUMVWlbB

  Score

  10^/10

  emotetbankerpersistencetrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2