MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 383be1968f87533ca5e745902220959c715161fa81e2824e76804679632ffa52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet (aka Heodo)

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	383be1968f87533ca5e745902220959c715161fa81e2824e76804679632ffa52
SHA3-384 hash:	e8055735cdebbeafcd71797943cb3a3f7687f402558045a7c82fa3cc9b548a25ee3d9c0d223208aa00a093353446e477
SHA1 hash:	2e94bf59025640b140d0740543f26d599006c84c
MD5 hash:	2926218b2a85e383a1f547ad014c9e61
humanhash:	beer-nineteen-berlin-crazy
File name:	emotet_exe_e2_383be1968f87533ca5e745902220959c715161fa81e2824e76804679632ffa52_2020-10-15__000133._exe
Download:	download sample
Signature	Heodo Create hunting rule
File size:	330'752 bytes
First seen:	2020-10-15 00:01:41 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ead6fc6ba5b456c616bd4986956ad404 (165 x Heodo)
ssdeep	6144:QsePWThcirxNiBR7qJdCFdoUzPi29bLbBYD5LIR5dJwW:QIrbGlIUzrKDdQ3
TLSH	5064AD2136D0C473D263357449EAE7B46BAEB8708B74978B3B94477D5F306928A3831B
Reporter	Cryptolaemus1
Tags:	Emotet epoch2 exe Heodo

Cryptolaemus1

Emotet epoch2 exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Emotet

Link:

https://www.capesandbox.com/analysis/71097/

Detection(s):

SecuriteInfo.com.Generic.mg.12272c113717cd9f.25924.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Connection attempt

Sending an HTTP POST request

Detection:

emotet

Link:

https://mwdb.cert.pl/sample/383be1968f87533ca5e745902220959c715161fa81e2824e76804679632ffa52/

Threat name:

Win32.Trojan.Emotet

Status:

Malicious

First seen:

2020-10-15 00:03:30 UTC

AV detection:

26 of 29 (89.66%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ha56dfupq5jtzjphiwiceievtryvcyp2qhriettwqbdhsyzp7jja._file

Result

Malware family:

emotet

Score:

10/10

Tags:

trojan banker family:emotet

Link:

https://tria.ge/reports/201015-4sj1xtx4zj/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Emotet Payload

Emotet

Malware Config

C2 Extraction:

47.36.140.164:80
169.50.76.149:8080
162.241.140.129:8080
104.131.123.136:443
95.213.236.64:8080
130.0.132.242:80
123.176.25.234:80
46.105.131.79:8080
157.245.99.39:8080
79.98.24.39:8080
49.50.209.131:80
72.143.73.234:443
50.91.114.38:80
89.216.122.92:80
5.39.91.110:7080
121.124.124.40:7080
71.72.196.159:80
5.196.74.210:8080
139.162.108.71:8080
61.19.246.238:443
91.211.88.52:7080
120.150.60.189:80
137.59.187.107:8080
139.59.60.244:8080
124.41.215.226:80
194.187.133.160:443
50.35.17.13:80
75.139.38.211:80
96.249.236.156:443
78.188.106.53:443
62.75.141.82:80
190.108.228.27:443
218.147.193.146:80
94.23.237.171:443
139.162.60.124:8080
96.245.227.43:80
174.106.122.139:80
113.61.66.94:80
93.147.212.206:80
203.153.216.189:7080
104.131.11.150:443
94.200.114.161:80
87.106.136.232:8080
69.206.132.149:80
172.91.208.86:80
110.145.77.103:80
188.219.31.12:80
71.15.245.148:8080
121.7.31.214:80
97.82.79.83:80
42.200.107.142:80
185.94.252.104:443
168.235.67.138:7080
91.146.156.228:80
24.137.76.62:80
87.106.139.101:8080
5.196.108.189:8080
194.4.58.192:7080
110.142.236.207:80
24.179.13.119:80
75.143.247.51:80
172.104.97.173:8080
216.139.123.119:80
118.83.154.64:443
74.208.45.104:8080
142.112.10.95:20
109.74.5.95:8080
104.131.44.150:8080
37.139.21.175:8080
139.99.158.11:443
220.245.198.194:80
140.186.212.146:80
78.24.219.147:8080
176.111.60.55:8080
37.187.72.193:8080
162.241.242.173:8080
209.141.54.221:8080
108.46.29.236:80
103.86.49.11:8080
174.45.13.118:80
68.252.26.78:80
62.30.7.67:443
134.209.36.254:8080
120.150.218.241:443
79.137.83.50:443
85.25.106.204:8080
186.74.215.34:80
80.241.255.202:8080
24.43.32.186:80
76.175.162.101:80
190.240.194.77:443
47.144.21.12:443

Unpacked files

SH256 hash:

383be1968f87533ca5e745902220959c715161fa81e2824e76804679632ffa52

MD5 hash:

2926218b2a85e383a1f547ad014c9e61

SHA1 hash:

2e94bf59025640b140d0740543f26d599006c84c

Link:

https://www.unpac.me/results/6ad68122-4b93-4ee2-ab55-17c6b25ea1bf/

SH256 hash:

b04d237f253b570fd7f9f4207fc804f2cc18905f967115b77835e6a03f28b938

MD5 hash:

ab49eecfb7b0e89b4a4ecab0b1530f0f

SHA1 hash:

c97b0a2e0c75f6af976c2a850a85784862f0bb0e

Detections:

win_emotet_a2

Link:

https://www.unpac.me/results/6ad68122-4b93-4ee2-ab55-17c6b25ea1bf/

Parent samples :

b96ee3e4ceca0fde2e561611130f4cca086527ba95348702bbc462043dfa46d9
0fad134f7898c05a0ed604578a8a7fc4f19c190e781175168d9b5b2c7929c086
60b70f2762ceeea386b66ec7c75cb5a6de0d3245d45eca49e48011857a5ed62c
1469457246edbb49ee4c2474a0e3a5b572fa93b97073cbca09f45e45f5d630ed
383be1968f87533ca5e745902220959c715161fa81e2824e76804679632ffa52
3fac4c0233b5dabf0fb963359f0033a787bc596cb9ed3eb329dfad13bac5f221
4e527facf44f8caa8a6b445d86e5d3d8d15160d890e3a98204a90d97b015cf42
7c24673a42c5315b27b533dd6fe8b849d331a18336a19700bfb2cc04a85219a9
e463a239cb6c96b5056028c1dfbed8c9b3161555276cd687e5a8ebd91002564f
dc6536c5a2f83f9707695f239619836b65709bbfdf8361f3471b124ba3ce385b
3bc5389807bd6cdf2abdf97ffe1f785211e38ae3ebc8f364d94b8f9980a60dc0
08dd945d864154b436be463edd8697c2b6dcbe780ff01966dc092d10a10f8126
1934982073658e881b6842ac787d54c0da668358c052f9ffbc090ec09c4944b6
5513d3032ce832686b9eac1ec56aa87e13a3a18c2d2f6f97dbe6b6ad7cb7abb2
21ee7229ab317861c4c49cd525fa06432f7474862748483fd00d65c43e96765b
bff4faf56744228cba8141cd624fd0f5a41398cf478b54258fc9096dd70db17e
5e53214a5b175dc95fb9d3f2ddb802b57ff6a31ac54d664a6ea1a1144c4f73e6
a8e5aba2051ddaf4b1a733143cbbd0c27dd34e9bbd480dc3ff22afcf54a0e716
ea3e8bf7b11a816fe98f21bbdc2315cb1ebffcef4cd0227468a6cfe7c85d3387
6a1d38748276c0000d2af72fab688d55839826e5592c80c0bf7a475ec08bfe7f
d0aafde3f362b04f58ac2296fc3f7578e3c2a715104fa96824473896920f0407
409adb1c2cf3a369d22711ac33082624ebe944ab57379ba148bc5d02fe318de7
d294708b500f7c50d7fa7d39b93ca7cbf97a2b4e2757afb1a7d4e36221cfc6e4
9a7c780f344002382e43ec61ba5aca661d926e1e4bffe02f9b6df59f2b419cca
8dd7e585f773b9e4b2c33ebb9d4f1344253934f02976289a4b89da88505ec6ef
676ee0dc68ea2cf57df5a06ab77a7f500625d71b760fc3d47125a300b85fc3d8
3916b553cd616df75003f4935db490878ac1f0e1967e1729221bea2e22aa674e
e70b11f7aaf2c0ceeedc926748c6b6d4e37b20738b6b519c747fc4eb4a1e837f
eea11d321d6e9f8b43a487809d29f8e34ad3ea5d708aec2e36a1d0a1cbf047e7
5e96cc1bfbd64f384759d23284e91624ab6b7b2d14b116e5935e18ec4483cdd4
3067195ea9227fb62cfbeda3b527d49c62e2678e165918c9e1035d09995899a8
8370d7b5c7c3a76dc72890fc7a359b8a59ae2857c515f5fc48abf89d711fa99d
9adf7e5dd3b18aeb2d3ff15c476d488b0f7ddacae51ea628e3a76f32b0568bd8
fd66c6a979c134180a1a5c9c1c0836f3ae537ff039e4a3e3c1436ff620bac911
3fa33c089bb41faf1eb544ec75ed95842fad87f96166bb0b3978211ed1e26b82
c7f138b616ed7ee4c433b5619f66a516c0122e05908a89198669a98b7faf9ad2
e0cb8f3c49fbedc94a8dcb951bc4a54d5d0cf24a7f1963becb043d18b4b76ab2
e5b2342b05124c205b6299d308b48cd568ff2eec208a003a98eb5faea3d5be24
680fd0a75063a6f5bd975d84de77be31be0d63f79c2dc2d44978bc8d1ceb17a4
2c4cca0b53ea1640adcb37825ad081971a0b31d78731d811b4debf968188410e

SH256 hash:

29b6809257f3027f1eef09a1f39ba97c6684defd0df9423a12b42e79237372b1

MD5 hash:

9989daa62c90c898b0db3846c5abf892

SHA1 hash:

e063288ca34819c500ec048802063128d7a9d170

Detections:

win_emotet_a2

Link:

https://www.unpac.me/results/6ad68122-4b93-4ee2-ab55-17c6b25ea1bf/

Parent samples :

66afd5d616a93accdc0568cd7c61e8712427fdb2216e2a7568018614e823eddd
a9d21104c5854cb79f100b6e8c918e8b20ccda5b7495d83a08da1a5332c542c8
2920f69decb353db1beacc3dbe06a4a21771fad5cb87a39d58a43d93d04a0c02
05c59deb9e6c4e69167b98e2851807550d73eadf7fc6c112c2f07d1710b5d019
004c3506c2fe50e775509e7dd10242d108f85e15460462344c93fbd222bf3667
024a399a6bccd3720dfd902e9eaad7c8051bc84ba24f19c867f779ead3722246
18537c8e062c84788f965a2c3af307b6b71cb2f2999e316b5ba6d0be420613ed
1d78c19cf906997be596928aa61e4265277532d0f509f84f1e9f9475735e0e86
f1a9b33249ace4f22d63a670ef886ad58afaa25a383a51e516dc67790a469ec7
a914d34075bb414875c547644e2a51d3f1e8890d6e1ff8c458c8d23eea6f386c
96ea37a4d3275d1e149eba6acb6fa4c719f883c7bf971f34ac195cd7635890a4
a45342ace61bbb51fa1c306da59c698a7c9d94ea35b29f0bee6fcaefa6ca32c2
98b33e9a610cd3a39023608cce81d1391475c463f8513f184ffda4866ec3ce01
71ceb2ab6db7ced7af2bdc3732a2c25307bd119e3b498acf112b840b0993730f
b96ee3e4ceca0fde2e561611130f4cca086527ba95348702bbc462043dfa46d9
0fad134f7898c05a0ed604578a8a7fc4f19c190e781175168d9b5b2c7929c086
60b70f2762ceeea386b66ec7c75cb5a6de0d3245d45eca49e48011857a5ed62c
1469457246edbb49ee4c2474a0e3a5b572fa93b97073cbca09f45e45f5d630ed
383be1968f87533ca5e745902220959c715161fa81e2824e76804679632ffa52
3fac4c0233b5dabf0fb963359f0033a787bc596cb9ed3eb329dfad13bac5f221
4e527facf44f8caa8a6b445d86e5d3d8d15160d890e3a98204a90d97b015cf42
7c24673a42c5315b27b533dd6fe8b849d331a18336a19700bfb2cc04a85219a9
e463a239cb6c96b5056028c1dfbed8c9b3161555276cd687e5a8ebd91002564f
dc6536c5a2f83f9707695f239619836b65709bbfdf8361f3471b124ba3ce385b
3bc5389807bd6cdf2abdf97ffe1f785211e38ae3ebc8f364d94b8f9980a60dc0
08dd945d864154b436be463edd8697c2b6dcbe780ff01966dc092d10a10f8126
1934982073658e881b6842ac787d54c0da668358c052f9ffbc090ec09c4944b6
5513d3032ce832686b9eac1ec56aa87e13a3a18c2d2f6f97dbe6b6ad7cb7abb2
21ee7229ab317861c4c49cd525fa06432f7474862748483fd00d65c43e96765b
bff4faf56744228cba8141cd624fd0f5a41398cf478b54258fc9096dd70db17e
5e53214a5b175dc95fb9d3f2ddb802b57ff6a31ac54d664a6ea1a1144c4f73e6
a8e5aba2051ddaf4b1a733143cbbd0c27dd34e9bbd480dc3ff22afcf54a0e716
ea3e8bf7b11a816fe98f21bbdc2315cb1ebffcef4cd0227468a6cfe7c85d3387
d9efffb9d2f3899df01595b153cff8f5f33f440980192b7e40df2f83c666915f
51cefa299df904aff0883a88eb429b2372705b00852b14e7a67dc433cdf51648
bc4dd668803731a3514da8f82ff7e396a79d9c056bdfd9724611ef5889949d53
9fc1e9e02aa79dceb6f55b1c1a66c487b26fdbb628e0d24677cf384c1552f7ad
904bf91664f7599b985be4825b9468416dbb4eeeac00d066c9d3b707286ef79d
b1a2a6d59f39343eadecaa72ba3a58130dc6e11b5d021bef47ad84c69a396241
65932a6a595769bd0472808c511fcec3a4d8a2cfafa1be71296ce06574c2c8f9
14824f506df7c700c9e86792a3c9167ffee361a5328ef529e667c4ffec4ace87
f55e892520b3f358dadc64e6a24ce793624f403fc9abf27d217e8fcc162c629e
9d4aea7dbe00f540262ead6baca52a8f520fd23b724bc1f7fdb5a0adcb273d3a
5ffd9a5bf65d6558ddb3fd5a2fcefa46ada5cfdd5a25880e3e44cf24d69c956f
72427be604007ffaa920e10a0f6dcdb285411d1cc997905b24d74cd1ddb2596e
decfde0ee01fab3460a974705fcb7d4da6f974184b49be879e2d93bc1eb0dbe8
f33350d6c6e75cffffb744254ce109ce76f9fabde43c81cc71bb779fa6c7c747
6a30b943570d94ad69115e6cf3aacad3d6e0c358991bc899c6dd7204741b567a
434848211b348256629cafc47e11888030b82906713d6c10e75331001d0f9ce2
20359c76d87189bd039f7c5cb39c84d569ff273e32d79fce49e5be70a4fe1965
6a1d38748276c0000d2af72fab688d55839826e5592c80c0bf7a475ec08bfe7f
f9ee7f45a3c91f4bb31c9be1cf9ad0e64229efc318a8b8f2efa24ef5ccf29476
5f3ba6bb15c112adbf039811e9b563e151cc5a27dde4e763deccf18ee4fb9e06
d0aafde3f362b04f58ac2296fc3f7578e3c2a715104fa96824473896920f0407
5833bee3b90cf0b36ab202dbbee8061d30bda5dba21c43c34b17aa0586e88ec4
9d0b8b4dcc02f64da46a404395847d31b40df508530dd4a00409a695ff174a4c
2618a8499370fb639637202cd5813e6e58d57ed82b3a2165486978c19c09f0ed
0a4d09257c555548c571fedd1c2a383f282157b71333c13146c9c3b4816d6a32
42c59fb11187984e1b36efb74a1970177b89d7af928798a34998f5ae81e5f3d2
9a021a1b44f4eaea00a308d3f20552387fd265bd0ce4218004be6a931f65ff03
f22cdbd5705786a2c268bd0991cbe9879d21bcfd48acf3d1697c9389de55599e
409adb1c2cf3a369d22711ac33082624ebe944ab57379ba148bc5d02fe318de7
93691d23abf37f897cf090e8bc847f13753b433468b78033a65405e7937eaf89
52495208edcce0ebad8a13b9932b552f1cff2ca61dcd5a75f3d43183629482c5
456601447ef17be3e8de02c92fa5edb85224d326e8297aef3e27a67d7c1311a1
85af36d140c9647da1f1c2b9e9c215f85f90d3c23c656854a2cb600b2b59386f
7d5e6ed19f65ae8d501cc65170fefdafa8e8349b91df9eaf6516ba2f27abe31d
85eb0950f376beb1ea94da608a9bb2164c22f91ae5ed1dcd1f92ca8a78106868
d294708b500f7c50d7fa7d39b93ca7cbf97a2b4e2757afb1a7d4e36221cfc6e4
f2b3503b870cb22835bb10211b1c2e860774d9568f8f99172a55e67e2b551b61
9a7c780f344002382e43ec61ba5aca661d926e1e4bffe02f9b6df59f2b419cca
a370eaeb1fe3646b0d363de552670b381e7c4625b6078ddef0e6606106e95c1c
8dd7e585f773b9e4b2c33ebb9d4f1344253934f02976289a4b89da88505ec6ef
ea6a72b9428f54a30cede0a36fcd0c50349abc6f4ab3c0fb770195cf40155d95
b05bb892f234d879d52bc32ac86317f7b13b5b836ce5061c62b62e90f3e49d58
0c1ed39d9cccbc78f14972a83d4cb601ad08618ba19bec834a2061eec2abaab3
9b2d75489ad81576e1d8049bf475d3334616e6b676c52d87a7c540b1b501e2ad
95ce561a854c6af7fa6f704eae4d4ecf0ea9c9b395d9f148ced2a692eab378cc
676ee0dc68ea2cf57df5a06ab77a7f500625d71b760fc3d47125a300b85fc3d8
f8eda38344991083e5e74344831d0cf3bc25e7daa5c0a013a8db2aaade5840f6
3916b553cd616df75003f4935db490878ac1f0e1967e1729221bea2e22aa674e
8e06a169b2e5db310f91fdb96411481a1b867a820593afd5aa62e605c6fba3cd
97aff1db66a2b53d28b37008f24c707761adb9da0ddf9ba068117dc97d7c89e8
e0331c531c278b7f4c37dcd073dde766366fe3c29d926923524fe7c63da4923a
e70b11f7aaf2c0ceeedc926748c6b6d4e37b20738b6b519c747fc4eb4a1e837f
94b2574cf18c6bcd0633b1a18d7aaafa1933d32bb9e8c38524bb7609297312c9
eea11d321d6e9f8b43a487809d29f8e34ad3ea5d708aec2e36a1d0a1cbf047e7
5e96cc1bfbd64f384759d23284e91624ab6b7b2d14b116e5935e18ec4483cdd4
b6bea0b4cb46ce5a3e81930019ff8ab4fa2ae4f455fd063fcbc00ef69a155778
d6202cab867a146d3ba63455a7a73251bc613b42d0d2b4679b27346699bbf647
315b83ded52a49c4bcc10b5921afbbe2a6a914382a976344c418f0b4f38fe663
fc18e10f319f07a4faea1b84902e905b954b730cab24447d9823a1706440e07f
3251b1bfdd83ac6df0737800d79e5fc499c410edf77d6cda5fc113daa2f53345
3067195ea9227fb62cfbeda3b527d49c62e2678e165918c9e1035d09995899a8
8370d7b5c7c3a76dc72890fc7a359b8a59ae2857c515f5fc48abf89d711fa99d
8862fcd5b2b2f95eee58dfd43a48d596e66d3aa6dedae252204429328451e367
1b905200ebe1e971eb2455e06a76ec4bf338600413deec543e7458e1041194d9
9adf7e5dd3b18aeb2d3ff15c476d488b0f7ddacae51ea628e3a76f32b0568bd8
8029ed4e48f62edf2e9d3997465c6602073dc03c9897e0f2f65cda8d1f2479e2
fd66c6a979c134180a1a5c9c1c0836f3ae537ff039e4a3e3c1436ff620bac911
1231fe231a01e5db15eb6d97aa62504cae7e6a7a3bc3d5380559703272079b2f
e402067ce066e8cc8cdce184e71c4fce5d2137f6792684f52b4e85b698285e88
45c3a49cd79967f8442055fb0a832cdd98c5082947a8ed2f9f45087cbd5a309b
02098fe2c668daa10d53b1ff638e8e24c834ea1df8469bacbc5ff770955c37c4
2ac5369e0f272254b1e59a535ce466909faf55be6b2771b38b907dcf07daa918
de45bf7b8e50575834a855d630b2a533c7ded21a42a40c7876a9ec8efd37daa2
4aa02c401444b7a41b862ac853e2ce441aadd4a5e5f3c7a1e7fe760b63fbbc12
3fa33c089bb41faf1eb544ec75ed95842fad87f96166bb0b3978211ed1e26b82
8faa67abf713c1d15b4e52ae10509049e8d75da8fb961aaa5c74dc2bff72980e
014b4b7656cbb871fb6d8f283258eaacaea35e8eb5517b4064f171fca7b96a14
c7f138b616ed7ee4c433b5619f66a516c0122e05908a89198669a98b7faf9ad2
ce8fb8acfd1fd426d5375fe205a1584fc7cc62f050c9f524ba36fe7fac3b10fe
e0cb8f3c49fbedc94a8dcb951bc4a54d5d0cf24a7f1963becb043d18b4b76ab2
34f1bf9de98302a9b8b0f8fbd53feec40037696e86b76ae3c019b76e2bdb74de
9237d5c54f346332da44e87940e70d2546adb70299340ab5d59422e321395b16
e5b2342b05124c205b6299d308b48cd568ff2eec208a003a98eb5faea3d5be24
0cac93907b0c5eec73c6a5e064278cb3a1cbf01d44751170ad1626e24585bdcf
680fd0a75063a6f5bd975d84de77be31be0d63f79c2dc2d44978bc8d1ceb17a4
be57439dbc508b27250721eb7f638e68ecc02d1b4e53a8cd406aae911de3e2a4
ab6e2325ef75858cf36098d82395d12a8e565bf1e1f532aa413d3c1f6c3e99f6
2c4cca0b53ea1640adcb37825ad081971a0b31d78731d811b4debf968188410e
11e0213d37d8756cb1aba36ab6d02040fc013c910a9c362492af7bd436832b82
5aeedf0b843c0d7c398457e5ce37b50a6f8c45d75bc0a493a98394b09945f6f6

SH256 hash:

90c0d77a160c70512cf2247f8b623bfaef562b0ddb367cba55436a01749128c7

MD5 hash:

7e421cbaf3db19860413ec55c5b03f61

SHA1 hash:

e0c56bfd536e6c0c535a353612478a3b2a7f16a6

Link:

https://www.unpac.me/results/6ad68122-4b93-4ee2-ab55-17c6b25ea1bf/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Emotet

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/383be1968f87533ca5e745902220959c715161fa81e2824e76804679632ffa52

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Cobalt_functions Create hunting rule
Author:	@j0sm1
Description:	Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

Rule name:	Win32_Trojan_Emotet Create hunting rule
Author:	ReversingLabs
Description:	Yara rule that detects Emotet trojan.

Rule name:	win_sisfader_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator