Malfam: Emotet | Detection.FYI

Attachment: LNK with embedded content

Jan 12, 2026 · Malfam: Emotet ·
Share on:

Emotet has been observed to embed executable content within an LNK file to deliver and execute VBScript when launched.

Similar research has demonstrated how this concept may be applied to deliver and launch an embedded executable via PowerShell.

Read More
Attachment: Emotet heavily padded doc in zip file

Jul 16, 2025 · Malfam: Emotet ·
Share on:

Detects a potential Emotet delivery method using padded .doc files that compress into small zip files. Contents may include Red Dawn templates exceeding 500MB.

Read More