Extracted

• • Target

    444afb61279aaf25f8166d9f23b9c56efb277cbe43dbbccef9f55407809842bf

  • Size

    3KB

  • MD5

    9d6cf11e83532493480dd167924d2165

  • SHA1

    b83c252564e2cc4b1b17d9279fe42bf3cf6b6326

  • SHA256

    444afb61279aaf25f8166d9f23b9c56efb277cbe43dbbccef9f55407809842bf

  • SHA512

    eb9b02ebc40b7de47cb72dc18b8685f3c64cb880b914ea5f90ab21fed543ec7769ada6ba11173b769f9fb23e9e29aa98499d932c9b7588d6bb5c72dae2d8351e

  Score

  10^/10

  executionemotetepoch4bankertrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Emotet family

    emotet

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2