MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 11971ee3b4f0561a86c5674fcac460538646f6898ff9ca7c9d8e82cf13567499. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 4


Intelligence 4 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 11971ee3b4f0561a86c5674fcac460538646f6898ff9ca7c9d8e82cf13567499
SHA3-384 hash: 52aadd46589b79e321d7568706d5446106128fb8539b4013141691e9dd51c9253dc94f689784755e3e01f4da573615ac
SHA1 hash: d08c4e465ecc1423b342464a892fa69a5a948c9a
MD5 hash: c82486e39af05f9fd28ce84687bed647
humanhash: kitten-green-magazine-winner
File name:11971ee3b4f0561a86c5674fcac460538646f6898ff9ca7c9d8e82cf13567499
Download: download sample
Signature Heodo
Create hunting rule
File size:585'728 bytes
First seen:2020-11-06 01:28:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ee32a7d07aff9fd88159f3d8028f0500 (758 x Heodo, 12 x TrickBot)
ssdeep 12288:7gyDT8PLvvaKrtURPnMXSVL6ZRwO+4DQDf2TPexaaiQgyDT+ctnRl3:7JDT8PjiKZcPM86rw0QJDTrnJ
Threatray 3'163 similar samples on MalwareBazaar
TLSH BEC49D1ACAD02141E84D88718C3945B91A7E5C37AC527E0BF780BA7939719C7ACFE71B
Reporter seifreed
Tags:Emotet Heodo

Intelligence

File Origin
# of uploads :
1
# of downloads :
54
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Generic-9784688-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Connection attempt
Sending an HTTP POST request
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/11971ee3b4f0561a86c5674fcac460538646f6898ff9ca7c9d8e82cf13567499/
Threat name:
Win32.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2020-10-29 10:16:08 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cglr5y5u6blbvbwfm5h4vrdakoden5ujr744u7e5r2bm6e2wosmq._file
Verdict:
unknown
Similar samples:
22c4f12b7643b56e99dd18190667094ea565b47aad5f254cea4a49868202bf07
Heodo
2964b5d28a8d65a8477f44ee1cc2b6859302f4e76e07a48217e9d948772ecb36
Heodo
569d02ef02eb74f77d7912980372d6711dfa30bfbcb6eaa487a8c370f64a1e25
Heodo
592cf5daf721f09abff87552f4e918af1b6c6d53b3e67ea3bc060884e988f518
Heodo
6943776fbe689678555633732e42b105c955535193d5a7b05eba01cf9c5d3780
Heodo
b544ff42f8c38e91027ec7df20b912d3c55dfe9235c6f4a609f7c8b57798b979
Heodo
c2820b8a81010204ade7c75dcc8eba016c3275d4f670d6ec80b0cb08f2aeaca8
Heodo
c321e5d2dd294190dcdc02438a5db924cad6a12d6727644bc3c04c00e0b029d9
Heodo
c679c2011e712ee0ae1956c77ae41d5d1009759b57fdd8cec97c3a08ece1ea5a
Heodo
e8f729ebca2fff6192e5223a96af260ff6d4ad3a3f6bdea9574317c0ac13f785
Heodo
+ 3'153 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201108-whc2gl6mns/
Behaviour
Suspicious use of SetWindowsHookEx
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Win32_Trojan_Emotet
Create hunting rule
Author:ReversingLabs
Description:Yara rule that detects Emotet trojan.
Rule name:win_emotet_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_trickbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
  
URLhaus
https://urlhaus.abuse.ch/url/755013/

Comments