MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 119b975ea6fde9731328437d1f1f4c5f7ea7d8d1b5e91bc2409c85467ac50d70. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet (aka Heodo)

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	119b975ea6fde9731328437d1f1f4c5f7ea7d8d1b5e91bc2409c85467ac50d70
SHA3-384 hash:	b901a63f821d9d507b467d405a645e551c49c17f0b2db27822c6924abf056dac160bf3bc385c2b45667b569029c1e562
SHA1 hash:	488638958d1597d1ced895e4e731e6d7eef95ed4
MD5 hash:	4c0692e85b4ce7f13c1156dafaca92fe
humanhash:	mango-black-golf-texas
File name:	119b975ea6fde9731328437d1f1f4c5f7ea7d8d1b5e91bc2409c85467ac50d70
Download:	download sample
Signature	Heodo Create hunting rule
File size:	453'120 bytes
First seen:	2020-11-12 14:32:15 UTC
Last seen:	2024-07-24 11:22:06 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	b9a828eedab63fed364da587e7a28d45 (72 x Heodo)
ssdeep	6144:bHIiIXBmmoK9U9xBoRqFQwypyEP6e2rvX6gJiYfUD1ZCDzPAuQyUr8iac5Qh:btIXBZlWxBoSEPOOgP8Dqz1QyUrdFQ
Threatray	17'414 similar samples on MalwareBazaar
TLSH	F3A4D02036E0C073C167213548EA97B8B676BE719F758647B7903B2E5E315E28E34B4B
Reporter	seifreed
Tags:	Emotet Heodo

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Win.Malware.Emotet-9778548-0

Win.Malware.Emotet-9778556-0

Win.Malware.Emotet-9778558-0

Win.Malware.Emotet-9778592-0

Win.Dropper.Generickdz-9780194-0

Win.Packed.Emotet-9790742-0

Win.Packed.Emotet-9790818-0

PUA.Win.Downloader.Firseria-6804617-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/119b975ea6fde9731328437d1f1f4c5f7ea7d8d1b5e91bc2409c85467ac50d70/

Threat name:

Win32.Trojan.Emotet

Status:

Malicious

First seen:

2020-11-12 14:35:38 UTC

AV detection:

27 of 29 (93.10%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cgnzoxvg7xuxgeziin6r6h2ml57kpwgrwxurxqsatscum6wfbvya._file

Verdict:

malicious

Label(s):

emotet

Result

Malware family:

emotet

Score:

10/10

Tags:

family:emotet botnet:epoch1 banker trojan

Link:

https://tria.ge/reports/201112-w8nrb2434j/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Emotet Payload

Emotet

Malware Config

C2 Extraction:

190.96.15.50:80
192.175.111.214:8080
95.85.33.23:8080
192.232.229.54:7080
200.127.14.97:80
190.188.245.242:80
51.15.7.145:80
138.97.60.140:8080
98.13.75.196:80
213.52.74.198:80
74.58.215.226:80
192.81.38.31:80
191.182.6.118:80
212.71.237.140:8080
209.236.123.42:8080
60.93.23.51:80
178.211.45.66:8080
190.24.243.186:80
62.84.75.50:80
50.121.220.50:80
137.74.106.111:7080
68.183.170.114:8080
70.32.115.157:8080
189.2.177.210:443
177.23.7.151:80
24.232.228.233:80
81.215.230.173:443
51.75.33.127:80
35.143.99.174:80
170.81.48.2:80
177.129.17.170:443
5.196.35.138:7080
51.255.165.160:8080
216.47.196.104:80
185.94.252.12:80
70.169.17.134:80
46.101.58.37:8080
192.241.143.52:8080
219.92.13.25:80
172.104.169.32:8080
152.169.22.67:80
77.238.212.227:80
104.131.41.185:8080
74.135.120.91:80
51.38.124.206:80
186.103.141.250:443
181.30.61.163:443
85.214.26.7:8080
190.190.219.184:80
37.187.161.206:8080
87.106.46.107:8080
12.162.84.2:8080
5.189.178.202:8080
83.169.21.32:7080
185.183.16.47:80
111.67.12.221:8080
68.183.190.199:8080
109.190.35.249:80
128.92.203.42:80
138.97.60.141:7080
1.226.84.243:8080
188.157.101.114:80
45.46.37.97:80
46.43.2.95:8080
70.32.84.74:8080
174.118.202.24:443
213.197.182.158:8080
149.202.72.142:7080
12.163.208.58:80
50.28.51.143:8080
82.76.111.249:443
177.144.130.105:8080
105.209.235.113:8080
94.176.234.118:443
45.33.77.42:8080
202.134.4.210:7080
177.73.0.98:443
181.129.96.162:8080
51.15.7.189:80
217.13.106.14:8080
178.250.54.208:8080
185.94.252.27:443
177.74.228.34:80
188.135.15.49:80
5.89.33.136:80
46.105.114.137:8080
190.115.18.139:8080
64.201.88.132:80
183.176.82.231:80
186.70.127.199:8090
177.144.130.105:443
191.191.23.135:80
201.213.177.139:80

Unpacked files

SH256 hash:

119b975ea6fde9731328437d1f1f4c5f7ea7d8d1b5e91bc2409c85467ac50d70

MD5 hash:

4c0692e85b4ce7f13c1156dafaca92fe

SHA1 hash:

488638958d1597d1ced895e4e731e6d7eef95ed4

Link:

https://www.unpac.me/results/8679f09f-cbd1-4f50-a7a0-fbfa79599c00/

SH256 hash:

237591f6dbeeb4e32c0d48134d7b68084a3c726a5a1ae58db8f8792d6fd1934d

MD5 hash:

9b9a13e0ce01aafd056c998a9fe3ba84

SHA1 hash:

38839ab0ab5ede4e3958e51b06bbd4dffd0e0dd5

Detections:

win_emotet_a2

win_emotet_auto

Link:

https://www.unpac.me/results/8679f09f-cbd1-4f50-a7a0-fbfa79599c00/

Parent samples :

d3a2d71b5190821f62ef62fd979e912e2395d8a5479f3104e7d125bfe14b4bb6
10449d9f3477978a9d555830305c817236b1125e29aba6730da8beecdacb0c33
781513560e150a34900e159fdfe643318c01fe34092de7dcc17f914a10b4bdf0
ca0f36d76eec62d8c02d69d5179c4c020cb9cfffd7011a99bfcb4f96bb128284
921c4ef625983795752ebc521764493664bf4563a6a7c817dbf71770f9873d48
b2c45406e0ae8695243a6e9a3297e1fa75b7bcd7054df458a29589ae4174a7d5
ce6b0653be744290b8ff7015662c06ff40ee7bbd76e78599c542b0d15bc9086d
afae098712ab4ca062645cdd8f9128a7c42c78b4147981ef44ad81266ed9bd97
7af217fd37fb58df024554c56d30042f1d09b67271bf6008819159cd8522bfaf
f747d72e90e27e2313325632a2a0c808e4020435d6b19432c576710a504a28e1
082d76d67d692a3eefa108f466b5b2cb647228f33888fb91e6a80f5c364afd9a
29055d7a058f2325fc9deba2f9b63ecbc37dc29436bd9a9b516eff746e0f1961
51457c20ae7b189934a79db83af9dd6ec015847e1f63ae960853067a78cb69b5
d7c4513b618eb8960020de6c2c4919c11a496232448c56aad15fd2f441736ff3
290af1bb273389153752dbafbfbe518be5c7233d39deac149583c718a7ceec47
76fb6f2452f1df499bb16e8cf4cb9d1e8409feb95b77df739db963b444560091
08e81ff5ab127e89ea6f9613fa2d0a92dbd1fbda7f32dccd3d5486b9f265460a
f224e6ecd9a251ad3674a5d8eb63428a67e9d5412f9e5a600e7e17f7f7b72a45
119b975ea6fde9731328437d1f1f4c5f7ea7d8d1b5e91bc2409c85467ac50d70
a79c9a62297e5696f7aafb3c4627ada368a99cfc57bf5f3a49019ac45a595271
6409a0cc171844d8346fdece2d5078c767d9f5e4f71ab0f7d92dd3c9c7fc04d6
9bd5b879a08ce4ac1be24cfdc4e0d1eea2041a0d3cfd0c13c6d54a103b743907
4ef5c3a3663f87c4ea1ba982fec90b6e96c67d35ace85cb399223def5ad940e4

SH256 hash:

7f56c4d26878a511829675b1dfab8395c8e9c7998b07c8d3c016214b282552a1

MD5 hash:

ccc996c33549143bb01e14b0d93b69d5

SHA1 hash:

adf5a2cfe29a62717c50f3fb549c6607b0181ad1

Detections:

win_emotet_a2

win_emotet_auto

Link:

https://www.unpac.me/results/8679f09f-cbd1-4f50-a7a0-fbfa79599c00/

Parent samples :

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Cobalt_functions Create hunting rule
Author:	@j0sm1
Description:	Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

Rule name:	Win32_Trojan_Emotet Create hunting rule
Author:	ReversingLabs
Description:	Yara rule that detects Emotet trojan.

Rule name:	win_emotet_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Delivery method

Other

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample