Extracted

• • Target

    YGO_1603.one

  • Size

    130KB

  • MD5

    da12437b78075441fd45d7164e5026d8

  • SHA1

    db23cfd305341c51226f2d0faf597310157f2e42

  • SHA256

    b753c666c74c62188ee8f87b964bc6a3bb347039a3a5f59176512b3a84e28334

  • SHA512

    07e3ae4c773e45540f22c81004f31e87f812071bdf61e562c87b5967a86e5447ddecaab0cee7e95ee2028a14b7f12fb7313bd2b3d356a5b78ad0b43b218c0abb

  • SSDEEP

    3072:PrfWMINYf3K19kzCnEEQvSMVnte8ZP1Y6J0cTgGv:d6nInM8TXJ5v

  Score

  10^/10

  emotetepoch5bankerpersistencetrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1