MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19906f16164720bf0cc6c29af1a16f9f36dca2a111e406c92def65548e836472. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet (aka Heodo)

Vendor detections: 6

Intelligence 6 IOCs YARA 3 File information Comments

SHA256 hash:	19906f16164720bf0cc6c29af1a16f9f36dca2a111e406c92def65548e836472
SHA3-384 hash:	8b84bc4b7171ec95ae46cd9f29e5d9eeab44ecb159183ac4ace5f0c2cfaf000fa0d2a3c01a3845b74e45ef609ee6ceea
SHA1 hash:	a5f525854863f0b4aacfbe6b5faa134dd54d17d0
MD5 hash:	2d856af187a4666cfdae63e3b2cfd3ae
humanhash:	emma-delta-stairway-uranus
File name:	emotet_exe_e2_19906f16164720bf0cc6c29af1a16f9f36dca2a111e406c92def65548e836472_2020-10-22__001533._exe
Download:	download sample
Signature	Heodo Create hunting rule
File size:	502'272 bytes
First seen:	2020-10-22 00:15:41 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	2fe547f059aca7520dab744809b9c233 (79 x Heodo)
ssdeep	12288:PvqNP1ohDKroqL25eP+hKAlGqGkdJRSx:kucroqKaYKyGqRnSx
TLSH	2EB4BE2176D0C432D16226790CE5D3B92B6ABC219F75878B7BD03F6FBE316D1492834A
Reporter	Cryptolaemus1
Tags:	Emotet epoch2 exe Heodo

Cryptolaemus1

Emotet epoch2 exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Emotet

Link:

https://www.capesandbox.com/analysis/74373/

Detection(s):

PUA.Win.Downloader.Firseria-6804617-0

SecuriteInfo.com.BehavesLike.Win32.Emotet.gh.11663.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Connection attempt

Sending an HTTP POST request

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/19906f16164720bf0cc6c29af1a16f9f36dca2a111e406c92def65548e836472/

Threat name:

Win32.Trojan.Emotet

Status:

Malicious

First seen:

2020-10-22 00:17:05 UTC

AV detection:

26 of 29 (89.66%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=dgig6fqwi4ql6dggyknpdilpt43nzivbchsansjn55svjdudmrza._file

Result

Malware family:

emotet

Score:

10/10

Tags:

trojan banker family:emotet

Link:

https://tria.ge/reports/201022-xx52w6hab2/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Emotet Payload

Emotet

Malware Config

C2 Extraction:

24.178.90.49:80
96.126.101.6:8080
5.196.108.185:8080
167.114.153.111:8080
188.219.31.12:80
184.180.181.202:80
85.105.111.166:80
174.106.122.139:80
137.59.187.107:8080
185.94.252.104:443
142.112.10.95:20
102.182.93.220:80
75.188.96.231:80
93.147.212.206:80
120.150.218.241:443
87.106.139.101:8080
78.188.106.53:443
75.139.38.211:80
46.105.131.79:8080
168.235.67.138:7080
96.245.227.43:80
172.86.188.251:8080
108.46.29.236:80
118.83.154.64:443
162.241.140.129:8080
2.58.16.89:8080
109.74.5.95:8080
110.142.236.207:80
68.252.26.78:80
190.29.166.0:80
5.39.91.110:7080
97.82.79.83:80
139.99.158.11:443
95.9.5.93:80
190.240.194.77:443
123.176.25.234:80
74.208.45.104:8080
174.45.13.118:80
103.86.49.11:8080
62.75.141.82:80
130.0.132.242:80
218.147.193.146:80
115.94.207.99:443
83.110.223.58:443
110.145.77.103:80
217.20.166.178:7080
91.146.156.228:80
71.72.196.159:80
50.91.114.38:80
87.106.136.232:8080
104.131.123.136:443
89.121.205.18:80
124.41.215.226:80
66.76.12.94:8080
208.180.207.205:80
62.171.142.179:8080
61.19.246.238:443
75.143.247.51:80
47.36.140.164:80
120.150.60.189:80
74.214.230.200:80
209.54.13.14:80
24.137.76.62:80
190.108.228.27:443
61.33.119.226:443
123.142.37.166:80
176.111.60.55:8080
172.91.208.86:80
50.35.17.13:80
113.61.66.94:80
49.3.224.99:8080
79.137.83.50:443
69.206.132.149:80
24.230.141.169:80
121.7.31.214:80
95.213.236.64:8080
162.241.242.173:8080
47.144.21.12:443
202.141.243.254:443
80.241.255.202:8080
89.216.122.92:80
71.15.245.148:8080
76.171.227.238:80
24.179.13.119:80
139.162.60.124:8080
220.245.198.194:80
91.211.88.52:7080
41.185.28.84:8080
121.124.124.40:7080
203.153.216.189:7080
94.230.70.6:80
139.59.60.244:8080
62.30.7.67:443
194.187.133.160:443
78.24.219.147:8080
50.245.107.73:443
119.59.116.21:8080
186.74.215.34:80
173.63.222.65:80
157.245.99.39:8080
76.175.162.101:80
186.70.56.94:443
155.186.9.160:80
37.139.21.175:8080
153.164.70.236:80
94.200.114.161:80
104.131.11.150:443
216.139.123.119:80
72.143.73.234:443
49.50.209.131:80
209.141.54.221:7080
98.174.164.72:80
139.162.108.71:8080
37.187.72.193:8080
194.4.58.192:7080
94.23.237.171:443
172.104.97.173:8080

Unpacked files

SH256 hash:

e8d7c6f588eff6cac570ee4485e2a63b6abf1f2e81f15af6a491e07726a668f6

MD5 hash:

21ad0ce5a6df109c5cf8d29663281b1a

SHA1 hash:

9d1098af727581522f3ed4094ead058e48ec434d

Detections:

win_emotet_a2

win_emotet_auto

Link:

https://www.unpac.me/results/d62424dc-1240-4791-ac27-d85c4ff45c32/

Parent samples :

fbcae980f2d759f55d105a997718bed1049673ea29c26095686d707d65a0ab5e
18418f644f42620fe3ff0477ca6dfe68bac83c59ac260d3d4320c7f7f7a3323d
e86ebc230bd876432fc7cc4a7fa5ac256a210552658cf7cf4df0cf4af7e71296
61ade1e011b6f07df344472b6b35b03b8b58d2ef43572647dee538c37ebc821f
7a22d72f8b63c01f660f96127346233544f5a297fa09353f35937fcbd0212198
d1f31bcbfe4d0d4a857ed376c6d048fd29763f5a629ffabb4a6667f9022d6a1f
19906f16164720bf0cc6c29af1a16f9f36dca2a111e406c92def65548e836472
31825aa3fcadba744458d4244542d37c873ed5f7130cd90e5f6ab70fe5936989
c03571d030f3b6fc784e4e6a8957c3e90d0f2897e06a37b9fcf629f5792cafb0
01e62240b757a0562cd4c946e8841b7b6f411aa88752926b3fdebffd79d0bbbe
b429e322bf9671c40cc4ac9880f1fb1c35510801d09d9b1cb9624043f1320973
6d8fa81fbd3e9d4f19b38abda371fc86531265da23b34691b4e5da73437d7e2a
ad8812994c52dcf591b8a0cdb0d79d039bf1455873b7e0ced2f03c8d8b2504a4
509a576de9f7830951dbefcf983b82b89595106851395cf5e5d4c165e8c3c14c
9d3563eb6214e558735305555838460ffe097e77e75a7e1d30522ebb48f123d5
44d930680be5bf1a56282202673f9b7ac13c6c2808136ad3e2bb53a06e46d3b4
88d52656c2bc915cc5e3a21516f39347e3d2227c4b7d3c09e736648523878923
6228369b1db37994b08838202ae25509021f9b5904d78abdde6fe838aca2c45d
62b5c02f0f0fa8f19972848bdf2d4dc957267864da151adcf97fec4eda5df709
21eda259e3b66a876df3b726eeffc0b0e22333e28d71ae782e18fc49f0fe148f
dcc1d9787d92e6b52d4dbb86088b1975e7bdf97eed3b01aa7061c12e902a863f
8d0da684c1ed85216f58423da725d067fdd6d1d413789eb49c8a37be4151d35c
dd5bbd2465e56173def94088da1bb9bacfdc55bcee178fae7a975370f3bb2d9b

SH256 hash:

7d2db32807e89815aadc2981aefe30dc23f7faf949e1f88976da7e564d3fe602

MD5 hash:

ce3fe22785d13b2d4d2ec11a41c53d11

SHA1 hash:

d26eff8c5588fb91c85180ef9f554eb1603b04a0

Detections:

win_emotet_a2

win_emotet_auto

Link:

https://www.unpac.me/results/d62424dc-1240-4791-ac27-d85c4ff45c32/

Parent samples :

SH256 hash:

19906f16164720bf0cc6c29af1a16f9f36dca2a111e406c92def65548e836472

MD5 hash:

2d856af187a4666cfdae63e3b2cfd3ae

SHA1 hash:

a5f525854863f0b4aacfbe6b5faa134dd54d17d0

Link:

https://www.unpac.me/results/d62424dc-1240-4791-ac27-d85c4ff45c32/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Cobalt_functions Create hunting rule
Author:	@j0sm1
Description:	Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

Rule name:	Win32_Trojan_Emotet Create hunting rule
Author:	ReversingLabs
Description:	Yara rule that detects Emotet trojan.

Rule name:	win_sisfader_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator