MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 31fb4bf411dcd7fcb860bdb1db26859290b047b39b94638a7d4fd2a46d323e98. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet

Vendor detections: 8

Intelligence 8 IOCs YARA File information Comments

SHA256 hash:	31fb4bf411dcd7fcb860bdb1db26859290b047b39b94638a7d4fd2a46d323e98
SHA3-384 hash:	436b76b0e68f6f6e94cad943d790979801b4632dff8e1ab4e82d6f488764fe42f9407d7050cb6df3d01dc7d13d49d921
SHA1 hash:	2caf7ddeb9fc1d6076558661ef69b9638cfd2e7b
MD5 hash:	9eae6f49a02d6eb9f75af7bbf4349808
humanhash:	moon-emma-delta-rugby
File name:	vbn540.vbs
Download:	download sample
Signature	Emotet Create hunting rule
File size:	91'102 bytes
First seen:	2023-03-23 17:11:53 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	768:vvQxmTUdOGFf77IlCpfj2d7gtD/uqDX4l8EE1:vvQxxOGV77Fj2sDRX4lG1
Threatray	6 similar samples on MalwareBazaar
TLSH	T19D9332D7AA57148CD060A3EB3008B5A2423603A3E570DD74E4D95C7FCDAAF8E61F4A9D
Reporter	Chainskilabs
Tags:	Emotet vbs

Intelligence

File Origin

# of uploads :

# of downloads :

385

Origin country :

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/376922/

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

emotet wscript.exe

Link:

https://www.filescan.io/uploads/641c886423f92296f1f0ad25/reports/f5b9f2b2-612c-4a27-8e62-a232e9c2c7aa/overview

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/31fb4bf411dcd7fcb860bdb1db26859290b047b39b94638a7d4fd2a46d323e98

Result

Verdict:

MALICIOUS

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/31fb4bf411dcd7fcb860bdb1db26859290b047b39b94638a7d4fd2a46d323e98/

Threat name:

Script-WScript.Trojan.Emotet

Status:

Malicious

First seen:

2023-03-23 14:48:58 UTC

File Type:

Text (VBS)

AV detection:

14 of 37 (37.84%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gh5ux5ar3tl7zodaxwy5wjufskilar5ttokghct5j7jki3jsh2ma._file

Verdict:

malicious

Label(s):

emotet

Emotet

68ff3fec9fb0d8b602fa8f568fae380d795f38ba7b7b2b3e9b0f85f795a887b5

Emotet

71635301df9bc1501e4bcfc7929edd9d080eafa6317b5383bf4c50d5fbd6dddd

Emotet

7921f1264b5ea1dd6c0ba0c7d0f7d5571b42452a5601f29e5f86704d7d73e273

Emotet

e2ea5af25c4e1942320c3893fadfd80955d059cd9fa0e9e8bb4e5b78f2c2576b

Emotet

f72c3339a6ce6a8ba0fe430773d99e890d19d54357d14e838501bfea0b1cb2f1

Emotet

Result

Malware family:

emotet

Score:

10/10

Tags:

family:emotet botnet:epoch4 banker persistence trojan

Link:

https://tria.ge/reports/230323-vqtzvaba8t/

Behaviour

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

Enumerates physical storage devices

Adds Run key to start application

Checks computer location settings

Loads dropped DLL

Blocklisted process makes network request

Emotet

Malware Config

C2 Extraction:

213.239.212.5:443
129.232.188.93:443
103.43.75.120:443
197.242.150.244:8080
1.234.2.232:8080
110.232.117.186:8080
95.217.221.146:8080
159.89.202.34:443
159.65.88.10:8080
82.223.21.224:8080
169.57.156.166:8080
45.176.232.124:443
45.235.8.30:8080
173.212.193.249:8080
107.170.39.149:8080
119.59.103.152:8080
167.172.199.165:8080
91.207.28.33:8080
185.4.135.165:8080
104.168.155.143:8080
206.189.28.199:8080
79.137.35.198:8080
103.132.242.26:8080
202.129.205.3:8080
103.75.201.2:443
149.56.131.28:8080
5.135.159.50:443
172.105.226.75:8080
201.94.166.162:443
115.68.227.76:8080
164.90.222.65:443
186.194.240.217:443
153.126.146.25:7080
187.63.160.88:80
209.126.85.32:8080
72.15.201.15:8080
153.92.5.27:8080
167.172.253.162:8080
147.139.166.154:8080
163.44.196.120:8080
183.111.227.137:8080
139.59.126.41:443
164.68.99.3:8080
188.44.20.25:443
94.23.45.86:4143

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/31fb4bf411dc/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.