MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 04e27aa6ddc283f3c942ed7bfdbbee1dcb040c0204d9ad178d7b1dacf812f092. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 04e27aa6ddc283f3c942ed7bfdbbee1dcb040c0204d9ad178d7b1dacf812f092
SHA3-384 hash: f2d2217de012c15b2d6097e1b4ffbdd0b36a781ec6c7857d38e8fa05e7993a76be4b02c2d192f471518019b2bd6c7e25
SHA1 hash: f55e04f01afe86c50efe3890b7a0f0cecf9ba9d3
MD5 hash: e187e0999a4fe464663c1a48e80f64a3
humanhash: golf-oscar-oranges-south
File name:file
Download: download sample
Signature Heodo
Create hunting rule
File size:541'696 bytes
First seen:2022-11-04 14:08:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash dd552575e0cf9d6f021ffe8e0937be8a (58 x Heodo)
ssdeep 6144:CvmTyW3ZBck+bvI0dfzJoQ/hVOjkIrkYKKGK6VWWOI0edWx7IBq9B:Cw09X38DGtWWOwdWlIB
Threatray 489 similar samples on MalwareBazaar
TLSH T131B48D01E7FD82E4D5F2D1349AB36622FAB17C89D638D39B4740C64A1B73B90A93E711
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter jstrosch
Tags:Emotet exe Heodo

Intelligence

File Origin
# of uploads :
1
# of downloads :
175
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
No threats detected
Analysis date:
2022-11-04 14:19:03 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/63bd8c0f-bc06-4754-82a6-7e7fc792962e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/328537/
Detection(s):
SecuriteInfo.com.Win64.BotX-gen.26265.22224.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching a process
Forced system process termination
Sending a custom TCP request
Moving of the original file
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/48465/overview
Behaviour
MalwareBazaar
MeasuringTime
SystemUptime
EvasionQueryPerformanceCounter
CheckCmdLine
EvasionGetTickCount
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware shell32.dll
Link:
https://www.filescan.io/uploads/63651d013c6c57b4ec40ff86/reports/16912fba-9d87-4d0e-8372-566c447652e8/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/68fab058-1d57-4d43-a658-702da56a91b5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/04e27aa6ddc283f3c942ed7bfdbbee1dcb040c0204d9ad178d7b1dacf812f092/
Threat name:
Win64.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2022-11-04 14:04:24 UTC
File Type:
PE+ (Dll)
Extracted files:
1
AV detection:
17 of 26 (65.38%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=atrhvjw5ykb7hskc5v573o7odxfqidacatm22f4npmo2z6as6cja._file
Verdict:
malicious
Label(s):
emotet
Create hunting rule
Similar samples:
260991072e60a01c41b556adc081eb5d8aadb4bf918a02cf67890b8fe3730fa2
Heodo
2be2c7e8605e5f6ba3ffecb25efa058f4475612789150d3e930bc4a32ad79a10
Heodo
371f264c56935dbd1fab2eb7091c1540179eafc2fb271cccd4430262d36492f8
Heodo
415cbb60e3ae0a08f3ac6000c143b7173780301858616d1a62987de853eedbe8
Heodo
5570858e15fef5c831cf7e875c23e266409dba6821a8d84c18f35d8aaa133be4
Heodo
8e97046c2607cdf9a4505233edb91e7cbe10140eb6fb1bbbad39897fd47f7e2c
Heodo
9eb753b1a1a3f74e9ad3de4edc0950c06aae8922477127eedc7949c73793ecce
Heodo
b3430ecda0d017491cfed9c7b8bea66ab71a5e9ad935fb511bc4ed0eb965fee6
Heodo
d653f080ba38483e08842cd775f8787f86a1f86cad07a612ec0e4fec8633d283
Heodo
f1430d7c9a852e9d7062237651b8139843a4092b2cb9970d0d3c2fedbdf67ff8
Heodo
+ 479 additional samples on MalwareBazaar
Result
Malware family:
emotet
Create hunting rule
Score:
  10/10
Tags:
family:emotet botnet:epoch4 banker persistence trojan
Link:
https://tria.ge/reports/221104-rf6zwahhcn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of WriteProcessMemory
Adds Run key to start application
Emotet
Malware Config
C2 Extraction:
45.235.8.30:8080
94.23.45.86:4143
119.59.103.152:8080
169.60.181.70:8080
164.68.99.3:8080
172.105.226.75:8080
107.170.39.149:8080
206.189.28.199:8080
1.234.2.232:8080
188.44.20.25:443
186.194.240.217:443
103.43.75.120:443
149.28.143.92:443
159.89.202.34:443
209.97.163.214:443
183.111.227.137:8080
129.232.188.93:443
139.59.126.41:443
110.232.117.186:8080
139.59.56.73:8080
103.75.201.2:443
91.207.28.33:8080
164.90.222.65:443
197.242.150.244:8080
212.24.98.99:8080
51.161.73.194:443
115.68.227.76:8080
159.65.88.10:8080
201.94.166.162:443
95.217.221.146:8080
173.212.193.249:8080
82.223.21.224:8080
103.132.242.26:8080
213.239.212.5:443
153.126.146.25:7080
45.176.232.124:443
182.162.143.56:443
169.57.156.166:8080
159.65.140.115:443
163.44.196.120:8080
172.104.251.154:8080
167.172.253.162:8080
91.187.140.35:8080
45.118.115.99:8080
147.139.166.154:8080
72.15.201.15:8080
149.56.131.28:8080
167.172.199.165:8080
101.50.0.91:8080
160.16.142.56:8080
185.4.135.165:8080
104.168.155.143:8080
79.137.35.198:8080
5.135.159.50:443
187.63.160.88:80
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/647bcd6a-c902-4684-8b4e-be2f83724a56
Unpacked files
SH256 hash:
04e27aa6ddc283f3c942ed7bfdbbee1dcb040c0204d9ad178d7b1dacf812f092
MD5 hash:
e187e0999a4fe464663c1a48e80f64a3
SHA1 hash:
f55e04f01afe86c50efe3890b7a0f0cecf9ba9d3
Link:
https://www.unpac.me/results/351e10ea-ec50-4691-a4d9-72cd419b5139/
Malware family:
Emotet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/04e27aa6ddc2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/04e27aa6ddc283f3c942ed7bfdbbee1dcb040c0204d9ad178d7b1dacf812f092

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Heodo

Executable exe 04e27aa6ddc283f3c942ed7bfdbbee1dcb040c0204d9ad178d7b1dacf812f092

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2398786/
Cape
Cape
https://www.capesandbox.com/analysis/328537/

Comments