Extracted

• • Target

    c0e21f6d-5b54-413f-aa1d-fb1d8aa5028a.one

  • Size

    130KB

  • MD5

    8e8ce65a20a03d3b95f3d3e9241124a6

  • SHA1

    e785450ebf5afc5062547c5f42c0ddc6a27aa394

  • SHA256

    b91c80e3643f82eae04a0f29f8aba4b7673bf92cbb33903ec8ee975d90c061c6

  • SHA512

    339c256c1564e296ecc8faf3ef1cef646039f96419467129f0dc79ee4884737c26f917ceae3e590050875a0a2e7af896eecbf6e006b202bc5b2e5cd733744111

  • SSDEEP

    3072:PrfWMINYf3K19kzCnEEQvSMVnte8ZP1Y6J0cTgG2:d6nInM8TXJ52

  Score

  10^/10

  emotetepoch5bankerpersistencetrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1