MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3496556ff888447c5f6d88776abb14b2f770c80ad7bc3a80ca572d384c8bffee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet (aka Heodo)

Vendor detections: 10

Intelligence 10 IOCs YARA 3 File information Comments 1

SHA256 hash:	3496556ff888447c5f6d88776abb14b2f770c80ad7bc3a80ca572d384c8bffee
SHA3-384 hash:	f09b26a77670e20c84a570a7d2e5031dd1a68a25f791932f7a0d477bbf0c6ae9b0878eb36387c95003d8779fd8c4aea1
SHA1 hash:	850d9dc8b27ff58a68e535f1f556eb9ae1806178
MD5 hash:	8bb9d4b2267ce8df5b43e21567d3225d
humanhash:	spaghetti-robert-mountain-hot
File name:	8bb9d4b2267ce8df5b43e21567d3225d
Download:	download sample
Signature	Heodo Create hunting rule
File size:	1'005'056 bytes
First seen:	2022-07-04 09:21:43 UTC
Last seen:	2022-07-04 10:12:24 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	b0a46373aba3b9c59d5abc399556519d (25 x Heodo)
ssdeep	12288:29qrdRdC0WEOcIf2lzjQijR24WhVxrokWFwwld26yChWV+JvNFUtXFfmUL:29qk00iQijR2VhVxrokW2w3rVVUXFOU
Threatray	4'370 similar samples on MalwareBazaar
TLSH	T152258D4BBBBC84B6D036D136C9434B5AE7B27C064B71C74F426047AA2F377A15E2A325
TrID	90.1% (.CPL) Windows Control Panel Item (generic) (197083/11/60) 4.8% (.EXE) Win64 Executable (generic) (10523/12/4) 2.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 0.9% (.EXE) OS/2 Executable (generic) (2029/13) 0.9% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):
dhash icon	8886a6a888c9d0b0 (52 x Heodo, 1 x Wapomi)
Reporter	zbetcheckin
Tags:	Emotet exe Heodo

Intelligence

File Origin

# of uploads :

# of downloads :

247

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.VHO.Trojan-Banker.Win64.Emotet.cmcs.23831.31168.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Creating a service

Launching a process

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Moving of the original file

Enabling autorun for a service

Result

Malware family:

n/a

Score:

10/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/23684/overview

Behaviour

MalwareBazaar

CursorPosition

SystemUptime

MeasuringTime

CheckScreenResolution

EvasionQueryPerformanceCounter

CheckCmdLine

EvasionGetTickCount

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

greyware keylogger packed

Link:

https://www.filescan.io/uploads/62c2b17a76fa5a5994411580/reports/8b7d47d2-e088-4940-a59b-ecee9878b6f8/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/de362d41-9a33-4cd4-9870-01dde9dca6a8

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3496556ff888447c5f6d88776abb14b2f770c80ad7bc3a80ca572d384c8bffee/

Threat name:

Win64.Trojan.Emotet

Status:

Malicious

First seen:

2022-07-04 09:22:21 UTC

File Type:

PE+ (Dll)

Extracted files:

AV detection:

16 of 25 (64.00%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=gslfk37yrbchyx3nrb3wvoyuwl3xbsak266dvagkk4wtqtel77xa._file

Verdict:

malicious

Label(s):

emotet

Result

Malware family:

emotet

Score:

10/10

Tags:

family:emotet botnet:epoch4 banker suricata trojan

Link:

https://tria.ge/reports/220704-lbw18aabd8/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of WriteProcessMemory

Emotet

suricata: ET MALWARE W32/Emotet CnC Beacon 3

Malware Config

C2 Extraction:

82.223.21.224:8080
173.212.193.249:8080
82.165.152.127:8080
151.106.112.196:8080
160.16.142.56:8080
163.44.196.120:8080
103.70.28.102:8080
164.68.99.3:8080
51.161.73.194:443
146.59.226.45:443
104.168.155.143:8080
101.50.0.91:8080
94.23.45.86:4143
167.172.253.162:8080
5.9.116.246:8080
185.4.135.165:8080
159.65.140.115:443
212.24.98.99:8080
209.97.163.214:443
206.189.28.199:8080
135.148.6.80:443
159.65.88.10:8080
79.137.35.198:8080
172.105.226.75:8080
172.104.251.154:8080
115.68.227.76:8080
201.94.166.162:443
144.91.78.55:443
183.111.227.137:8080
45.176.232.124:443
209.126.98.206:8080
72.15.201.15:8080
197.242.150.244:8080
51.254.140.238:7080
45.235.8.30:8080
103.75.201.2:443
207.148.79.14:8080
213.239.212.5:443
110.232.117.186:8080
153.126.146.25:7080
188.44.20.25:443
45.55.191.130:443
134.122.66.193:8080
131.100.24.231:80
186.194.240.217:443
64.227.100.222:8080
51.91.76.89:8080
159.89.202.34:443
149.56.131.28:8080
196.218.30.83:443
103.43.75.120:443
213.241.20.155:443
91.207.28.33:8080
129.232.188.93:443
119.193.124.41:7080
45.118.115.99:8080
158.69.222.101:443
150.95.66.124:8080
37.187.115.122:8080
107.170.39.149:8080
103.132.242.26:8080
1.234.2.232:8080
139.59.126.41:443

Unpacked files

SH256 hash:

48c8d07c711aa09f78477b62a9732ba4612ee74da1b0e58686fb1916fd32664c

MD5 hash:

96e07d5d6e09b9a0053d8dacf9a09ba1

SHA1 hash:

647a7c91e16e30d54989ed061e0ff5dee8ea49e5

Detections:

win_emotet_a3

Link:

https://www.unpac.me/results/94030b8d-3c84-487d-bbb3-1b9ae77cd0fd/

Parent samples :

206a7f59e72cb0e861d8394f68a4a1b914c063666fe3be45172f5952e58609f2
0c6397c0986328c45430ab9afc7f6e37307c71e6f2498f415d307bf2c657c2f5
cec74ec60b60223d2335afc7e65906be202c954118c9acd3ddd808746ae9bfb3
7cf0cdf72a6bd9885301161d19c5104849db894d810ea18fbbdee60bb7a29f28
0ef03bd59f6302e0c8274bb8fbe2e59a03b03e88a33915cd6a06a44c7761af21
4f416fe5267f772789ba35f118bacbbb24fe66e9d233e599b548648cae4bad00
ca0b295b10ce093bda5af331536b8c6157ec525b8d936af1ce7d4ef9b89a4796
3f8512fdedde0cb40896f0e7e24a8fd229957b7892ee66a4eaedc6f7740456f6
286bbe177a88174e0f01f760938fb8c9c1f0ad25b87e6d25f197f6139347e439
8e65c9beb7e05e30f1173b7b679d0855cb2792461a652487b6333576c49339c1
34be37323043a600dc65b2eb4c92d61546b5eda364a1b9c1ea20335e80d7cd42
4a3574edad50e6d011169bb4b7509cadffcb472e83656705e8d88245d828e3d3
0cae82182df793980a935c45db2b9e3c6835a5d829d1a243586d6b6a7dce1d99
946cba82d74d786e7000b5ece1a2ee1688e849af2edfaa9edfbaa5ae8fe50bc1
aa86e3d1b3dcc90d8536d25e44d536febb9f02cd4498c568c75d37fc7f0edeb7
f5c19d6ef52ff13f5ebdbdc0f379c3998c2acb59ea5715b850988079d6d395c6
3496556ff888447c5f6d88776abb14b2f770c80ad7bc3a80ca572d384c8bffee
90a51ecb3b1e5ffbe5eb122d0bcd892651bc69bdbc52bf15b3617f8de5d3d230
48707278b4d9e2542ec01f0de17cb443878dc15ccc67bd10f7ad5e5832be132f
43a2f7627d000a8d091ab2baa148e32f3000201010de690c217dc6f67a90e8e2
3d097c5010f8ea090e4e7d629e271c9c244da927a43588217e209e24132f23ca
e262f3e231a54e43db925f49d2c409364383dde4b8a8171add22fa89dc11c952
323f144c61f267d783900972e8d4ef466c918d09e5639aced339d95b47b2e7b5

SH256 hash:

3496556ff888447c5f6d88776abb14b2f770c80ad7bc3a80ca572d384c8bffee

MD5 hash:

8bb9d4b2267ce8df5b43e21567d3225d

SHA1 hash:

850d9dc8b27ff58a68e535f1f556eb9ae1806178

Link:

https://www.unpac.me/results/94030b8d-3c84-487d-bbb3-1b9ae77cd0fd/

Malware family:

Emotet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/3496556ff888/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	crime_win64_emotet_unpacked Create hunting rule
Author:	Rony (r0ny_123)

Rule name:	Emotet_Botnet Create hunting rule
Author:	Harish Kumar P
Description:	To Detect Emotet Botnet

Rule name:	win_heodo Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Heodo

exe 3496556ff888447c5f6d88776abb14b2f770c80ad7bc3a80ca572d384c8bffee

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2253702/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2022-07-04 09:21:47 UTC

url : hxxps://www.duinrand-s.nl/Nieuws/S9Y8DumfrBU1r5unO/