MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02aaf083124e0064c6d00f7e1d5228e7cd401a3c0f96020124fd17dcd36f49bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 02aaf083124e0064c6d00f7e1d5228e7cd401a3c0f96020124fd17dcd36f49bc
SHA3-384 hash: 22f4965d2abc9dbaed7829dc1b73dd3f6a2287e04673854b183028471f8b823d06c0a4046a9cee54c479be2b50f46249
SHA1 hash: 6dc15da4eb78426b9d97747b6d33a53b763ca50a
MD5 hash: d69df9a9602f03ae18525bac7651c1d8
humanhash: twenty-uniform-delaware-hawaii
File name:CS9MPM.dll
Download: download sample
Signature Heodo
Create hunting rule
File size:522'675 bytes
First seen:2022-06-08 17:14:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 17a9db8a367c83d15112ca6763718dff (6 x Heodo)
ssdeep 12288:9OT6sIypRSjjElCBQCRbpNdUzJwxDD2+UkoX8LlGf:9OT6zypRSfyHCRbyKVD2+UkoX8hGf
Threatray 228 similar samples on MalwareBazaar
TLSH T146B49E17A69194B7C086C330D5DBA731B331BCAD07239A2B5A61C7385EA67E04F6DB1C
TrID 56.8% (.EXE) InstallShield setup (43053/19/16)
17.2% (.SCR) Windows screen saver (13101/52/3)
13.8% (.EXE) Win64 Executable (generic) (10523/12/4)
3.9% (.MZP) WinArchiver Mountable compressed Archive (3000/1)
2.6% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter pr0xylife
Tags:Emotet epoch5 exe Heodo

Intelligence

File Origin
# of uploads :
1
# of downloads :
301
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
report-2781679.xls
Verdict:
Malicious activity
Analysis date:
2022-06-08 17:16:53 UTC
Tags:
macros loader
Link:
https://app.any.run/tasks/a7d97b07-087c-4ba7-ab7a-2277323f73c3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/277866/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a service
Launching a process
Sending a custom TCP request
Moving of the original file
Enabling autorun for a service
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe greyware overlay packed spyeye
Link:
https://www.filescan.io/uploads/62a0d9205dc88d35716c3ca6/reports/3375c35c-23bc-4400-a3b1-2bb8ca107c06/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Emotet
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4a6c5a98-37e2-4577-a81f-8ea4d7937941
Result
Threat name:
Emotet
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1009258
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Multi AV Scanner detection for domain / URL
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected Emotet
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 641752 Sample: CS9MPM.dll Startdate: 08/06/2022 Architecture: WINDOWS Score: 88 47 103.224.241.74 WEBWERKS-AS-INWebWerksIndiaPvtLtdIN India 2->47 49 202.29.239.162 UNINET-AS-APUNINET-TH Thailand 2->49 51 37 other IPs or domains 2->51 65 Snort IDS alert for network traffic 2->65 67 Multi AV Scanner detection for domain / URL 2->67 69 Antivirus detection for URL or domain 2->69 71 2 other signatures 2->71 9 loaddll64.exe 1 2->9         started        11 cmd.exe 1 2->11         started        13 cmd.exe 1 2->13         started        15 13 other processes 2->15 signatures3 process4 dnsIp5 18 regsvr32.exe 5 9->18         started        21 cmd.exe 1 9->21         started        23 rundll32.exe 2 9->23         started        33 2 other processes 9->33 25 conhost.exe 11->25         started        27 wevtutil.exe 1 11->27         started        29 conhost.exe 13->29         started        31 wevtutil.exe 13->31         started        59 20.190.160.15, 443, 49887, 49888 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 15->59 61 192.168.2.1 unknown unknown 15->61 35 12 other processes 15->35 process6 signatures7 63 Hides that the sample has been downloaded from the Internet (zone.identifier) 18->63 37 regsvr32.exe 12 18->37         started        41 rundll32.exe 2 21->41         started        43 regsvr32.exe 23->43         started        process8 dnsIp9 53 104.244.79.94, 443, 49762 PONYNETUS United States 37->53 55 212.83.184.188, 49748, 8080 OnlineSASFR France 37->55 57 173.249.25.219, 443, 49759, 49760 CONTABODE Germany 37->57 73 System process connects to network (likely due to code injection or exploit) 37->73 75 Hides that the sample has been downloaded from the Internet (zone.identifier) 41->75 45 regsvr32.exe 41->45         started        signatures10 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/02aaf083124e0064c6d00f7e1d5228e7cd401a3c0f96020124fd17dcd36f49bc/
Threat name:
Win64.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2022-06-08 17:15:11 UTC
File Type:
PE+ (Dll)
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=akvpbaysjyagjrwqb57b2uri47guagr4b6laeaje7ul5zu3pjg6a._file
Verdict:
malicious
Label(s):
emotet
Create hunting rule
Similar samples:
30f9d040a73df0f937a088de32e12b91ec4a1af8c053d19eff2722993e3aa06d
Heodo
329c1c3b1d799550a827941cec64efe4e8d09e991faf76796da13917cc7a36d8
Heodo
385eead4433d5af8a091282fa5c0fd98bf431b3a19b2880c67e355605d34fe52
Heodo
64492ee5d824de451cfe96b60031c1c0423d25b245a5574ceab98fe92bc0ae82
Heodo
6bbce57af634b5a56f4e412c52d987d3c2515089fc82be156c3de564564b25ba
Heodo
8290655a81cf1cee72d85aee9889729d9d2691ee506e4bd590896b6b5cc5ab08
Heodo
f2ce387dc7fca0e222d78155858865a04ef9ee1158027083155156c370558fad
Heodo
f409d5bf0243e26545b73dec63552af42f941aa1734cbac9db0ec5b2fa37ac23
Heodo
f69a3264a6a766ae855ec772e5e0e81613571e11336848f0e55ce2a6fcd406dc
Heodo
fb1ac3a68fd2c28f4bcdace6e51e96a8c65789a2eef1209755bc5afbe133fb98
Heodo
+ 218 additional samples on MalwareBazaar
Result
Malware family:
emotet
Create hunting rule
Score:
  10/10
Tags:
family:emotet botnet:epoch5 banker suricata trojan
Link:
https://tria.ge/reports/220608-vsjlwschb8/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of WriteProcessMemory
Emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
Malware Config
C2 Extraction:
78.47.204.80:443
212.83.184.188:8080
36.67.23.59:443
128.199.217.206:443
103.56.149.105:8080
202.29.239.162:443
68.183.91.111:8080
104.244.79.94:443
64.227.55.231:8080
157.230.99.206:8080
165.232.185.110:8080
103.71.99.57:8080
103.126.216.86:443
88.217.172.165:8080
103.41.204.169:8080
87.106.97.83:7080
85.25.120.45:8080
188.225.32.231:4143
118.98.72.86:443
178.62.112.199:8080
210.57.209.142:8080
62.171.178.147:8080
37.44.244.177:8080
54.37.228.122:443
202.28.34.99:8080
103.254.12.236:7080
196.44.98.190:8080
59.148.253.194:443
85.214.67.203:8080
195.77.239.39:8080
173.249.25.219:443
103.85.95.4:8080
175.126.176.79:8080
157.245.111.0:8080
93.104.209.107:8080
139.196.72.155:8080
54.37.106.167:8080
165.22.254.236:8080
116.124.128.206:8080
103.224.241.74:8080
202.134.4.210:7080
104.248.225.227:8080
Unpacked files
SH256 hash:
3e9e67c43bdcb652c97c559ea5fd01adc7b946154013f9b50eef508dd87168d3
MD5 hash:
b13a6c30e2e3143e33df858f79931df6
SHA1 hash:
269a1fbe571b55573a19508b01e3f8feeaa61863
Link:
https://www.unpac.me/results/c77992be-d3d3-4db4-afc0-2f449317b936/
Parent samples :
f35a6b822b1cd88cd25db29768dc0621b9a957906397f97eb0168f73c08c462c
917d246ac14d2f1838f4e1fc5a6fcb76b9ec446ba9ca458fe9b34f79e4b850ed
3e0087df099c88887d486b304322cfe8a48a695d93069506fb4a1e44ed22e029
9800f49ba56ad7bfd245e2536ea9fb41902dd42939b1da1d1f17368661884b3b
9f3627379892387a910cf681f8ed4647dcf3ca8f78334fb255ccb688c0d2e361
7c19d5122b5a53cc94e520654d9df4dcd29788f50622980380cbd213ef4d0cfd
75c89c0a25349dfa151d830cfb3e3702d7c8c0e685c45fd40b5049abbec85658
56feabf14fb5d52e34839e217c8421e3c9c84b73390c13fb9972825275590fd4
6247619f1c688c71530ab4c911ed86bd3a00617ff68e229476414f60db829b15
b74c7b83f8d5372fb42b9a6e135dc9597d1e168525ceaa5d49a53068ef1dfab2
a74a09baae29c607ee97e0feb18d744afdd363866f4212573fd80ff867f904d4
d6bd1484e4fe3229664ff184aea1a54e68a1992483bc3756a6e822675e223631
2974c6c1f71f3a24e78cc2d6a4be1579c86ed4a23a27490ea0e8d3334db27180
177044fff475a20f8627abdb0a1015289eb6b1f7daae2710e8885a7a205711d7
e3754c42606197042ec2577c7ce628475968a9bd768d642de4b06bbacdef51c0
5e277567be32da8041cab1d074c42244489349c462957a73dfe9036b815561cb
a97a86507df6c5e4e21350ae907aef2bfff3758ce03cf0986ffa9d4d1d731ab5
2f191173842cf5808e2190a22113e17513af9bcabaf72394c7ced7b1ea4fc89e
b6e99d14270ec5664475a8865d454614924c40636fb2c0933d342414b9b9c558
ff2fdbaa6bda76f7a8f986fc371393eebb590b87c010e2000b72a0dee8b7221a
ff2e11e969f3c84ca6d80a3fa243ab70611b0a812d7b8f0abdc268a3c005acc0
SH256 hash:
02aaf083124e0064c6d00f7e1d5228e7cd401a3c0f96020124fd17dcd36f49bc
MD5 hash:
d69df9a9602f03ae18525bac7651c1d8
SHA1 hash:
6dc15da4eb78426b9d97747b6d33a53b763ca50a
Link:
https://www.unpac.me/results/c77992be-d3d3-4db4-afc0-2f449317b936/
Malware family:
Emotet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/02aaf083124e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/02aaf083124e0064c6d00f7e1d5228e7cd401a3c0f96020124fd17dcd36f49bc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/277866/

Comments