Cryptolaemus on Twitter: "#emotet Update - As of the last few hours Ivan is running some tests on E4 to try to bypass detection by appending a VBS at the end of an LNK file in a zip. The LNK when launched will find a string in itself and then copy the remainder from that string after to a VBS file. 1/x" / Twitter
https://twitter.com/Cryptolaemus1/status/1517634855940632576