Trojan:Win32/Emotet!pz (file analysis)

The Trojan:Win32/Emotet!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Emotet!pz virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Spanish
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Behavioural detection: Transacted Hollowing
• CAPE detected the embedded win api malware family
• Collects information to fingerprint the system
• Yara detections observed in process dumps, payloads or dropped files

How to determine Trojan:Win32/Emotet!pz?

File Info:
name: E98684F3B220ECD823F4.mlw
path: /opt/CAPEv2/storage/binaries/f54574cde0b264e770ffb6940e8fc6a47df318e6d81b34b6506b9dca047d1144
crc32: A1B94A3A
md5: e98684f3b220ecd823f4736c1a0109f2
sha1: 66cf783b53c0a58aad5020d7fef4e7ea07c26dff
sha256: f54574cde0b264e770ffb6940e8fc6a47df318e6d81b34b6506b9dca047d1144
sha512: 00a441fda8eac4ff79de2d989568748f0a2ef338263fb1febc5a9c27b62d195041ec61d9746a8b2ae68daa2aa5d809df7ba0c2172fd11e6b785dd17b4ada2cdb
ssdeep: 6144:+v2l9mmNYmoZ9rajNIgUE2zbFwFWo/bGqc:D/mKmZYj2gvEbFwF//2
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B01412ADAF04EBB2D8A13D39945B2F8037E17D7EE4E03A166810F6BCD2729E75453412
sha3_384: 3e8b722edc1418f94aa7a015aa6a79bf4ea669a8dca2de5a3b96f6ba91a400255b53b554619c70617a6c369e93b0a022
ep_bytes: 60be151043008dbeebfffcff5783cdff
timestamp: 2013-06-30 03:48:05

Version Info:
CompanyName: Hilgraeve, Inc.
FileDescription: HyperTerminal Applet
FileVersion: 5.1.2600.0
Translation: 0x0409 0x0000

Trojan:Win32/Emotet!pz also known as:

How to remove Trojan:Win32/Emotet!pz?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.