Extracted

• • Target
    SecuriteInfo.com.Trojan.Agent.FRJZ.5659.28079
  • Size 83KB
  • SHA256 c9a3300d453b49ea41ff4ceb73f52d67bce3361c38544dd461c146a3ebcf995b
  • MD5 54b111eda70d930ca35cfed4f1cb64eb
  • SHA1 5251df7903d85af9753f005ede619f58a88297a1
  • SHA512 dc30c957fad387980b2b360627ad949dc111f851555864d6cea1adaefd2ce083e89ffd3ac672d85a5ff068e9beb95238d9da9a6e6f47bb0f45f28a739d3ab153
  • MD5 SHA1 SHA512

  Score

  10^/10

  suricata

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2