Max_Malyutin on Twitter: "#Emotet LNK new arsenal hits with PS1🚨 #DFIR Exec Flow: LNK > PowerShell > PowerShell > Regsvr32 > regsvr32 Distro URL: hxxp://focusmedica[.]in/fmlib/IxBABMh0I2cLM3qq1GVv/ C2: 138.201.142[.]73:8080 LNK > VBS Exec flow: https://t.co/sOjyqg3WB5 @Cryptolaemus1 https://t.co/a7fbtltYhK" / Twitter
https://twitter.com/Max_Mal_/status/1518730615352401921