Extracted

• • Target

    813cc090-521b-48ce-99a4-bf54cb76c0ed.one

  • Size

    130KB

  • MD5

    80c4e58c69d72382332f0009f53fc2ae

  • SHA1

    6cdb162661d48016e0f8dd0aa36528ca523aabd5

  • SHA256

    2a51c42cb4da0f4e4666e20296481967f37be7e1154f8500be4aeaf26f4ea729

  • SHA512

    c7897fa612a0209d8d3a3a9434bfa83859aaccb4ce2c60632744e94302d877c675ad77ad4396a456d569b946ea4e0f42106523e41ba4f016ec3e2527e6df7f68

  • SSDEEP

    3072:PrfWMINYf3K19kzCnEEQvSMVnte8ZP1Y6J0cTgGJ:d6nInM8TXJ5J

  Score

  10^/10

  emotetepoch5bankerpersistencetrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1