MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3c2b6b3e8f51037cc187d21553b9ffae5ae710884ec207336637bd9c0080a010. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet (aka Heodo)

Vendor detections: 11

Intelligence 11 IOCs YARA 2 File information Comments

SHA256 hash:	3c2b6b3e8f51037cc187d21553b9ffae5ae710884ec207336637bd9c0080a010
SHA3-384 hash:	c0b510baad42d50cc71a50a8ea7178bd1c118472a0f7a3d433c4ed87f644e5c5e6574c5dc6f0c7540fa57a4bc81bd143
SHA1 hash:	241ad513350df95765c3e12fb27e31b2e30b44b2
MD5 hash:	3e123298b06f75ecd3d4f0f8524f83c2
humanhash:	twenty-edward-nitrogen-equal
File name:	3e123298b06f75ecd3d4f0f8524f83c2.dll
Download:	download sample
Signature	Heodo Create hunting rule
File size:	903'168 bytes
First seen:	2022-11-04 17:14:02 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	c8d1998b80cffee902d21a3223b8978f (186 x Heodo, 1 x Emotet)
ssdeep	12288:OY67TI+4RcCD01BkNsNi0MBpIwz0WMWQdshDQxxA3:Opk+4Rj01BkN3tphz0WMTmcK
Threatray	1'861 similar samples on MalwareBazaar
TLSH	T16115BF12B3E403B5E5B7E238CE768A45EAB2BC5A5630E34B03E491557F23761493F326
TrID	48.7% (.EXE) Win64 Executable (generic) (10523/12/4) 23.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 9.3% (.EXE) OS/2 Executable (generic) (2029/13) 9.2% (.EXE) Generic Win/DOS Executable (2002/3) 9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter	Anonymous
Tags:	dll Emotet exe Heodo

Intelligence

File Origin

# of uploads :

# of downloads :

154

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

3e123298b06f75ecd3d4f0f8524f83c2.dll

Verdict:

No threats detected

Analysis date:

2022-11-04 17:16:45 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/7e3e1edd-533c-459f-bb22-31ab0113e12e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/328615/

Detection(s):

SecuriteInfo.com.Win64.BotX-gen.11588.32681.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Сreating synchronization primitives

Launching a process

Forced system process termination

Moving of the original file

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/48521/overview

Behaviour

MalwareBazaar

MeasuringTime

EvasionQueryPerformanceCounter

CheckCmdLine

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware shell32.dll

Link:

https://www.filescan.io/uploads/63654865d8b92f0ee64c571c/reports/d4d446be-a57c-4c16-840b-97f5e2b5ee28/overview

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/78bba3a2-52d7-4e08-abee-3623308f58b7

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3c2b6b3e8f51037cc187d21553b9ffae5ae710884ec207336637bd9c0080a010/

Threat name:

Win64.Trojan.Injuke

Status:

Malicious

First seen:

2022-11-04 15:41:51 UTC

File Type:

PE+ (Dll)

Extracted files:

AV detection:

13 of 26 (50.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hqvwwpupkebxzqmh2ikvhop7vznooeeij3baom3gg66zyaeauaia._file

Verdict:

malicious

Label(s):

emotet

Result

Malware family:

emotet

Score:

10/10

Tags:

family:emotet botnet:epoch4 banker persistence trojan

Link:

https://tria.ge/reports/221104-vr1h1sbagm/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of WriteProcessMemory

Adds Run key to start application

Emotet

Malware Config

C2 Extraction:

45.235.8.30:8080
94.23.45.86:4143
119.59.103.152:8080
169.60.181.70:8080
164.68.99.3:8080
172.105.226.75:8080
107.170.39.149:8080
206.189.28.199:8080
1.234.2.232:8080
188.44.20.25:443
186.194.240.217:443
103.43.75.120:443
149.28.143.92:443
159.89.202.34:443
209.97.163.214:443
183.111.227.137:8080
129.232.188.93:443
139.59.126.41:443
110.232.117.186:8080
139.59.56.73:8080
103.75.201.2:443
91.207.28.33:8080
164.90.222.65:443
197.242.150.244:8080
212.24.98.99:8080
51.161.73.194:443
115.68.227.76:8080
159.65.88.10:8080
201.94.166.162:443
95.217.221.146:8080
173.212.193.249:8080
82.223.21.224:8080
103.132.242.26:8080
213.239.212.5:443
153.126.146.25:7080
45.176.232.124:443
182.162.143.56:443
169.57.156.166:8080
159.65.140.115:443
163.44.196.120:8080
172.104.251.154:8080
167.172.253.162:8080
91.187.140.35:8080
45.118.115.99:8080
147.139.166.154:8080
72.15.201.15:8080
149.56.131.28:8080
167.172.199.165:8080
101.50.0.91:8080
160.16.142.56:8080
185.4.135.165:8080
104.168.155.143:8080
79.137.35.198:8080
5.135.159.50:443
187.63.160.88:80

Verdict:

Informative

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/695afefc-f2f5-4c56-b990-870ccfd94b18

Unpacked files

SH256 hash:

3c2b6b3e8f51037cc187d21553b9ffae5ae710884ec207336637bd9c0080a010

MD5 hash:

3e123298b06f75ecd3d4f0f8524f83c2

SHA1 hash:

241ad513350df95765c3e12fb27e31b2e30b44b2

Link:

https://www.unpac.me/results/021d35ed-5e08-4bf1-b414-24000f3b95ea/

Malware family:

Emotet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/3c2b6b3e8f51/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3c2b6b3e8f51037cc187d21553b9ffae5ae710884ec207336637bd9c0080a010

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com