[sysopfb]

Magical builtin hijack.

Attached is a sample from 19sep with the anti layer in the crypter they are referring to.

[ikolor]

hi

https://www.virustotal.com/#/file/c7484 ... /detection

[Antelox]

hi

https://www.virustotal.com/#/file/c7484 ... /detection

This is Geodo/Emotet doc downloader.

It downloads this: https://www.virustotal.com/en/file/0775 ... /analysis/

BR,

Antelox

[ikolor]

next

https://www.virustotal.com/#/file/04ec0 ... /community

[Antelox]

next

https://www.virustotal.com/#/file/04ec0 ... /community

Geodo/Emotet doc downloader.

Downloads this: https://www.virustotal.com/en/file/b4e2 ... /analysis/

BR,

Antelox

[ikolor]

thanks

https://www.virustotal.com/#/file-analy ... IwNzU0MA==

[Antelox]

thanks

https://www.virustotal.com/#/file-analy ... IwNzU0MA==

Geodo/Emotet doc downloader.

BR,

Antelox

[ikolor]

thanks the same shit

https://www.virustotal.com/#/file/dfd70 ... /detection

[Antelox]

thanks the same shit

https://www.virustotal.com/#/file/dfd70 ... /detection

Geodo/Emotet doc downloader.
Download this: https://www.virustotal.com/en/file/a267 ... /analysis/

BR,

Antelox

[tomatto007]

thanks the same shit

https://www.virustotal.com/#/file/dfd70 ... /detection

Geodo/Emotet doc downloader.
Download this: https://www.virustotal.com/en/file/a267 ... /analysis/

BR,

Antelox

FILES ADDED:
%LOCAL APPDATA%\MICROSOFT\WINDOWS\ISONET.EXE

VALUES ADDED:
HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ISONET: "%LOCAL APPDATA%\MICROSOFT\WINDOWS\ISONET.EXE"