Extracted

• • Target

    e84029f170c30875ebeaedc8768bc843dafbd12e1cedf82503914ea10f20a6c3.xls

  • Size

    217KB

  • MD5

    788173d27edd59db2c29320cfb9f751c

  • SHA1

    25b4cda0bbe461580b67c232591deedd46a71c4f

  • SHA256

    e84029f170c30875ebeaedc8768bc843dafbd12e1cedf82503914ea10f20a6c3

  • SHA512

    bd38909f08534651633f9a5e4ff8a8ac690a6c87aaf0376bd4cb5287bd2c6a1387d8285935cccd7373ff42c3490a819fe0cb2939efd5a6c325ba65ef22066a51

  • SSDEEP

    6144:OKpb8rGYrMPe3q7Q0XV5xtuEsi8/dg8yY+TAQXTHGUMEyP5p6f5jQmd:nbGUMVWlbd

  Score

  10^/10

  emotetbankerpersistencetrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2