Extracted

• • Target

    c7a9355b272440826e9c534f5b65bccb5a222a6298200674092b5cfe5c31cbfc.xls

  • Size

    217KB

  • MD5

    0e418b517559f1c8a8fae6f55de2be46

  • SHA1

    e72e81d6dcf50e628e7603ce304ebe26cecb0aa2

  • SHA256

    c7a9355b272440826e9c534f5b65bccb5a222a6298200674092b5cfe5c31cbfc

  • SHA512

    56181569c1107f06302f28f3271945f4a653b3aee0bfa457888213303adb21d3f494485c596d73327dfbc64204d79bf24a4bbb7fdc8b2fa0804a32143bcddfa3

  • SSDEEP

    6144:OKpb8rGYrMPe3q7Q0XV5xtuEsi8/dg8yY+TAQXTHGUMEyP5p6f5jQmx:nbGUMVWlbx

  Score

  10^/10

  emotetbankerpersistencetrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2