SYMBOLCOMMON_NAMEaka. SYNONYMS
js.unidentified_003 (Back to overview)

Unidentified JS 003 (Emotet Downloader)

Actor(s): MUMMY SPIDER


According to Max Kersten, Emotet is dropped by a procedure spanned over multiple stages. The first stage is an office file that contains a macro. This macro then loads the second stage, which is either a PowerShell script or a piece of JavaScript, which is this family entry.

References
2020-04-14Max Kersten
Emotet JavaScript downloader
Unidentified JS 003 (Emotet Downloader)

There is no Yara-Signature yet.