Extracted

• • Target
    SecuriteInfo.com.Trojan.Agent.FRJZ.29036.8617
  • Size 83KB
  • SHA256 48f75fe3ade801f9f0595a0e404a181e7a039a96f312ef285cb9d647efd21d2a
  • MD5 21bfbb28d58b4ba4d3da02ec4811bb23
  • SHA1 6bab15352cf8bbb21606f344be644a64e5b6a950
  • SHA512 c909dce0704cbfe81d9e5771ae647d56f8b75f9d3aad317bbcee4b71c6258dc9a9058fd4b437a88eb983d88888c986c6bfdb17c45b414a6a0ad8b8628d68db4d
  • MD5 SHA1 SHA512

  Score

  10^/10

  suricata

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2