MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 12449bb00d21b4109606488d739abe928c168b7b8361c3d88bd6baf42cdeeb9c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 12449bb00d21b4109606488d739abe928c168b7b8361c3d88bd6baf42cdeeb9c
SHA3-384 hash: 34c922c0c61abdd952efdc8dc9358062fadfed9947422e62b062c441e9102a3272b57120c6d9c596b9f5dc3f0e8b4307
SHA1 hash: fe0fac5b6d53d71d6d22d8463cd46f713d7cb42d
MD5 hash: b788d2a63e3f523f5c0a1054c04e71f8
humanhash: william-mockingbird-moon-music
File name:emotet_exe_e5_12449bb00d21b4109606488d739abe928c168b7b8361c3d88bd6baf42cdeeb9c_2021-11-19__071206.exe
Download: download sample
Signature Heodo
Create hunting rule
File size:488'448 bytes
First seen:2021-11-19 07:12:11 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash faaa0f8f720b9e939fe2971010f39e24 (14 x Heodo)
ssdeep 6144:H+cR0IAEb+CAh+X98eKOwdt7a56AOMXo4Tp3gJlp+6n1A4QimgjZv4SU:H+cRXF7t8eRwT66CXLpEl1AtIjZvFU
Threatray 125 similar samples on MalwareBazaar
TLSH T136A4BF02B482E472E0AE14342978D7A60E6D7DB40FA8C9D777E81A6D4F752C35F31A36
Reporter Cryptolaemus1
Tags:dll Emotet epoch5 exe Heodo


Avatar
Cryptolaemus1
Emotet epoch5 exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
159
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.Variant.Fragtor.42427.3191.28296.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/61974e874912a8c920a37363/reports/73742b61-9aae-41d4-a8aa-b0ef25b3ca7b/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2f15de74-acdc-403e-b654-4be0bd502a36
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/12449bb00d21b4109606488d739abe928c168b7b8361c3d88bd6baf42cdeeb9c/
Threat name:
Win32.Trojan.Fragtor
Create hunting rule
Status:
Malicious
First seen:
2021-11-19 07:13:09 UTC
AV detection:
9 of 44 (20.45%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
emotet
Create hunting rule
Similar samples:
0062304503f928e8bb0e8bf3fe2466bb4fe26050bf658cf11b4c91019ddf3c3d
Heodo
20385691b83c23010aff7923eafbd39d6fd3c9717982ba2d2478e6cbf5154fe7
Heodo
207b6e0048c2cc9fb8373f0632fcd33675eb2a469e830a408929fcf73c2d8137
Heodo
26dac81120fd574e8e1d26eaaabf95cc8b067143790fb74fc31742ae35201510
Heodo
44e938b73bb581c9302b64f769ea68dcb8f3eda6391175591666c3d302a30894
Heodo
53bdf298136671fbd0439a89acb040c5050682e1cd70e5cd90ef2bd3b2a552f0
Heodo
797dfa91b28b201f2d24de7f44c8c742dce4a2b8217ec08dc7c7d118d5aa0e5f
Heodo
9bd6222d52643d35e6ca9be6ef63967b04e41baf7c5949fae6555e40dc7816f2
Heodo
9d5831122224eb743846ef6367f5fccfbb234f1c0dc733d9990bf77727c619c8
Heodo
d5f9cc8ca764f029ba5b496345a91d3484619915bf02cfd6c960d73df8724633
Heodo
+ 115 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/211119-h14wkshedl/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
721e424359552595120fc89db4008ef069446f2c5433084d6d6e472cc26d6e49
MD5 hash:
bfc068f011ce18fe6232176bc6e09613
SHA1 hash:
bb21623aec101681a813120d5118574dd542192c
Detections:
win_emotet_a2
Create hunting rule
win_emotet_auto
Create hunting rule
Link:
https://www.unpac.me/results/1645e0ef-6546-47f2-9567-c4ba02cef846/
SH256 hash:
12449bb00d21b4109606488d739abe928c168b7b8361c3d88bd6baf42cdeeb9c
MD5 hash:
b788d2a63e3f523f5c0a1054c04e71f8
SHA1 hash:
fe0fac5b6d53d71d6d22d8463cd46f713d7cb42d
Link:
https://www.unpac.me/results/1645e0ef-6546-47f2-9567-c4ba02cef846/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/12449bb00d21b4109606488d739abe928c168b7b8361c3d88bd6baf42cdeeb9c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Heodo

DLL dll 12449bb00d21b4109606488d739abe928c168b7b8361c3d88bd6baf42cdeeb9c

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/207488/
  
URLhaus
https://urlhaus.abuse.ch/url/1799208/
  
Delivery method
Distributed via web download

Comments