Extracted

• • Target

    ef39a4c5-e103-4864-b407-aa3cae93a2da.one

  • Size

    130KB

  • MD5

    26536394856810329c581f10ed447ea6

  • SHA1

    3b0ac9019ebb2584b2717edd8a0ba20ae552316e

  • SHA256

    de0c83d2a892769355585e17c1930ba46a5f320f2bf7fb8c0e553e47014e5467

  • SHA512

    7f995edaabe1896f1d7469c33f15bfdb68dfd925746d9aa0012828387e7b818048eec1ff27931b2dada9f2eeb0e53bd9a140f9094bdf6937191001490bf4237d

  • SSDEEP

    3072:PrfWMINYf3K19kzCnEEQvSMVnte8ZP1Y6J0cTgGG:d6nInM8TXJ5G

  Score

  10^/10

  emotetepoch5bankerpersistencetrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1