Extracted

• • Target

    f652524ac5e433d6debdbdd7832ab99d119c572314e157cc5858095ddca23153.xls

  • Size

    217KB

  • MD5

    9ff837252c8480f5bed617ffea3ceb4b

  • SHA1

    8e300e69f3de75c78d4be89310519a7ab3f7c712

  • SHA256

    f652524ac5e433d6debdbdd7832ab99d119c572314e157cc5858095ddca23153

  • SHA512

    376bb451aa8c5bcd642053601109f7383bbadcded8a6ca645d323a8b15e61e3c33dce971325fb16a31023071536ca145d77f0a7b4df1995e611d7f9945cf930b

  • SSDEEP

    6144:OKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgIyY+TAQXTHGUMEyP5p6f5jQmb:bbGUMVWlbb

  Score

  10^/10

  emotetbankerpersistencetrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2