Extracted

Extracted

• • Target

    dfb3f80bfb984d61bb524dd5f4b271d8fbe2df1c2edccc7737a330c3876433a9.xls

  • Size

    217KB

  • MD5

    ab868bbdf36decbf040bcefbf1ce5883

  • SHA1

    95d8a07982d0aeeecd7ef6e79bce720eb8296a32

  • SHA256

    dfb3f80bfb984d61bb524dd5f4b271d8fbe2df1c2edccc7737a330c3876433a9

  • SHA512

    94dcbd8021b49709ad863789c286d9cae68bd76c4046356619723b5a1aa4959eea374b09a52156bb9ebe846e72e23af348d8419155c01aaa4759f7ad751b650c

  • SSDEEP

    6144:OKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgIyY+TAQXTHGUMEyP5p6f5jQmb:bbGUMVWlbb

  Score

  10^/10

  emotetepoch5bankerpersistencetrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2