Extracted

• • Target

    info_0.one

  • Size

    261KB

  • MD5

    9933577fa741233071f0714d7fbffbff

  • SHA1

    ebd87f765c4e82c02a6cdd590b74a322f8457450

  • SHA256

    8fd4f59a30ef77ddf94cfb61d50212c8604316634c26e2bd0849494cba8da1af

  • SHA512

    a840f6806a5dfedfdd2b7504748edb2e5dca171bb4cba2e69850a30bb5d0389abe2259c87cbdf91a6e3d844f02baedb0aaf1ceefc388ebd806f2928fc0064630

  • SSDEEP

    3072:xXzeHrBwsHzUfxJ3mY2IsGllOb3HPWaBtOzUfxJ3mY2IsGllOb3HPWaBtuXj:FeHrBwsYXm5ZGa3vRXm5ZGa3v2

  Score

  10^/10

  emotetepoch4bankertrojanpersistence

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2