MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2db0758d60d1e61b6c69778283df5dde77c84cc771b29953c9821433f348b336. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet (aka Heodo)

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	2db0758d60d1e61b6c69778283df5dde77c84cc771b29953c9821433f348b336
SHA3-384 hash:	4a7cba72e835d04b07411e1f952ae4a1428a75fcb6953247157056b875be44f8989faabac30d5b6241af55105636aa48
SHA1 hash:	8d4cb110522a8fc4b2b810622e01ee7868dce09c
MD5 hash:	471cc802e8c51fe22eaa3a5e348bf904
humanhash:	cold-dakota-eleven-gee
File name:	emotet_exe_e1_2db0758d60d1e61b6c69778283df5dde77c84cc771b29953c9821433f348b336_2020-08-31__224902._exe
Download:	download sample
Signature	Heodo Create hunting rule
File size:	315'392 bytes
First seen:	2020-08-31 22:49:07 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	28e13268bb9c9d127728a8e76142c4d7 (2 x Heodo)
ssdeep	6144:shtZ/O0wVh0hcPb3DTCDlJ3sXn1ROUH7:MKh0hGbzOJ3sdb
TLSH	C56427223581CC72C7DA45F609C6C2F962E178ACDFA3426F36D4EF1D6E332911A291E5
Reporter	Cryptolaemus1
Tags:	Emotet epoch1 exe Heodo

Cryptolaemus1

Emotet epoch1 exe

Intelligence

File Origin

# of uploads :

# of downloads :

110

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Emotet

Link:

https://www.capesandbox.com/analysis/53767/

Detection(s):

PUA.Win.Downloader.Aiis-6803892-0

PUA.Win.Downloader.Firseria-6804617-0

Result

Verdict:

Clean

Maliciousness:

Behaviour

Launching the default Windows debugger (dwwin.exe)

Sending a UDP request

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2db0758d60d1e61b6c69778283df5dde77c84cc771b29953c9821433f348b336/

Threat name:

Win32.Trojan.Emotet

Status:

Malicious

First seen:

2020-08-31 22:51:05 UTC

AV detection:

24 of 28 (85.71%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=fwyhldla2htbw3djo6bihx253z34qtghogzjsu6jqikdh42iwm3a._file

Result

Malware family:

n/a

Score:

4/10

Tags:

n/a

Link:

https://tria.ge/reports/200831-8k7t4hgwls/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Program crash

Drops file in Windows directory

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2db0758d60d1e61b6c69778283df5dde77c84cc771b29953c9821433f348b336

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Cobalt_functions Create hunting rule
Author:	@j0sm1
Description:	Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT