MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 45608c2e465ce3ae7c65b4afd5edd86d80ade8f21b892561a34cf6a588c844da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 45608c2e465ce3ae7c65b4afd5edd86d80ade8f21b892561a34cf6a588c844da
SHA3-384 hash: 1daf4b5acaeb69856f9c2d2ceb61f5bea42dd8ade8b53e6d773f8746ad421fc5b386abf9d1b70643bd86c0e018a58c93
SHA1 hash: aade978e72e9715f58dafda3a4f7a7228480ee66
MD5 hash: e1babdba6b1a11f94e4130228faa266a
humanhash: spaghetti-mobile-triple-illinois
File name:emotet_exe_e5_45608c2e465ce3ae7c65b4afd5edd86d80ade8f21b892561a34cf6a588c844da_2022-02-03__191949.exe
Download: download sample
Signature Heodo
Create hunting rule
File size:635'904 bytes
First seen:2022-02-03 19:20:04 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 15b471bbc15a140b9567d4daee05d632 (17 x Heodo)
ssdeep 12288:8m9+I/aI+W1QbBi3IjeuXe6q7nCt/xCMqYDl2JwDKCX:8XrbB2IjevCyMqW2uX
Threatray 1'583 similar samples on MalwareBazaar
TLSH T182D4C05472A28476E0AEA83404249B138D6E7F715FB0C4DBD7E539AE4D3D2D16A30E3B
Reporter Cryptolaemus1
Tags:dll Emotet epoch5 exe Heodo


Avatar
Cryptolaemus1
Emotet epoch5 exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
115
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Emotet
Create hunting rule
Link:
https://www.capesandbox.com/analysis/232692/
Detection(s):
SecuriteInfo.com.Ransom.Win32.Emotet.luheur.12516.25121.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
DNS request
Launching a process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe greyware packed
Link:
https://www.filescan.io/uploads/61fc33d26d25ac9e7901e219/reports/cf9860da-1718-4410-a09b-bd77fb9c4211/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c4431cc7-88c9-453e-a961-af388784d9e3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/45608c2e465ce3ae7c65b4afd5edd86d80ade8f21b892561a34cf6a588c844da/
Threat name:
Win32.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2022-02-03 19:21:15 UTC
File Type:
PE (Dll)
Extracted files:
7
AV detection:
20 of 27 (74.07%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ivqiylsgltr247dfwsx5l3oynwak32hsdoeskyndjt3klcgiitna._file
Verdict:
malicious
Label(s):
emotet
Create hunting rule
Similar samples:
100c34ec95c4532941ad7b71a5a51d53380273549c31902cf85c2622d7cc4cb9
Heodo
34fd06edc922a08c37c59dad3604f7c52aa98e89645718cf81ff48d9eb40f791
Heodo
4290625a5625d56de3bd8cdd2cc3950be245253d9d7e5cc9c3973ffedb7c236c
Heodo
54fc4be9bfb128285b4842cca2963ee3e7fc785797e0fe7d03569fe32513a21c
Heodo
573527569b666ab420ce960a3463b5e85a94e4c789ec947874c0d57bb582a598
Heodo
6665bd0411d67a02b0b0e9d163621ee115489c2a46e75a6920ad41c7be86d978
Heodo
84213caddc94fd53e672051d1bced76840c4b69cfdc228704bd3e7971d327c1e
Heodo
bb361ea7d3df1c501aae619b81321f8bae2f28a15ce51a6b064350d5d16ff3ff
Heodo
cf76aa4d22e2e002717af8e8b5c2a666fd0410f5c87e47bce8482fc81593c73a
Heodo
f4041dd3d7e616fce49e1e3ee6fb319d69ec7dd7ed41fc9958693d590d53fee1
Heodo
+ 1'573 additional samples on MalwareBazaar
Result
Malware family:
emotet
Create hunting rule
Score:
  10/10
Tags:
family:emotet botnet:epoch5 banker persistence trojan
Link:
https://tria.ge/reports/220203-x19jdsdae3/
Behaviour
Checks processor information in registry
Modifies data under HKEY_USERS
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Sets service image path in registry
Emotet
Malware Config
C2 Extraction:
174.136.15.27:8080
185.122.58.89:443
66.42.57.149:443
159.69.237.188:443
78.47.204.80:443
54.38.242.185:443
37.44.244.177:8080
185.148.168.220:8080
217.182.143.207:443
198.199.98.78:8080
139.196.72.155:8080
59.148.253.194:443
195.77.239.39:8080
210.57.209.142:8080
128.199.192.135:8080
173.203.78.138:443
62.171.178.147:8080
85.214.67.203:8080
185.148.168.15:8080
191.252.103.16:80
190.90.233.66:443
185.184.25.78:8080
207.148.81.119:8080
104.131.62.48:8080
78.46.73.125:443
37.59.209.141:8080
118.98.72.86:443
54.37.228.122:443
168.197.250.14:80
93.104.208.37:8080
54.37.106.167:8080
116.124.128.206:8080
194.9.172.107:8080
203.153.216.46:443
195.154.146.35:443
103.41.204.169:8080
Unpacked files
SH256 hash:
cc9490219db724bdc010a397f420919050cef3188669172e81e0c6d11fbf554f
MD5 hash:
b009ee5add63157e799fde4f59c64dd4
SHA1 hash:
43e9f17fbbb99ebe3d57a4be99c07ca1bc2287ff
Detections:
win_emotet_a2
Create hunting rule
win_emotet_auto
Create hunting rule
Link:
https://www.unpac.me/results/21ef2f4b-0c9e-4db1-8f39-a18dfcf92940/
SH256 hash:
45608c2e465ce3ae7c65b4afd5edd86d80ade8f21b892561a34cf6a588c844da
MD5 hash:
e1babdba6b1a11f94e4130228faa266a
SHA1 hash:
aade978e72e9715f58dafda3a4f7a7228480ee66
Link:
https://www.unpac.me/results/21ef2f4b-0c9e-4db1-8f39-a18dfcf92940/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/45608c2e465ce3ae7c65b4afd5edd86d80ade8f21b892561a34cf6a588c844da

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Heodo

DLL dll 45608c2e465ce3ae7c65b4afd5edd86d80ade8f21b892561a34cf6a588c844da

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/232692/
  
URLhaus
https://urlhaus.abuse.ch/url/2026738/
  
Delivery method
Distributed via web download

Comments