Extracted

• • Target

    71c7536a10c7233f2b7854681f1a1d6a8d90b8bbd53a564981be8b584b700ec0.xls

  • Size

    217KB

  • MD5

    3745f6ea8f881e0324d8ddb316ab750e

  • SHA1

    1d1ae8ddfee01d5351cc425225e8cd98c68aeb2d

  • SHA256

    71c7536a10c7233f2b7854681f1a1d6a8d90b8bbd53a564981be8b584b700ec0

  • SHA512

    d5e6995df157063c986db6d6a3700a834774695b41d062ef9f1d62fa41e350438a0eaf30cae3f801dd5708e02ffd19151407aff8262d6d636d68a85641f55cfd

  • SSDEEP

    6144:OKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgIyY+TAQXTHGUMEyP5p6f5jQmH:bbGUMVWlbH

  Score

  10^/10

  emotetbankerpersistencetrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2