MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 45a2abf71a6f1111f2ff6b8303ac09a4cb0ca338f9c38758f7a9b2bf40432909. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet (aka Heodo)

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	45a2abf71a6f1111f2ff6b8303ac09a4cb0ca338f9c38758f7a9b2bf40432909
SHA3-384 hash:	c81721985161436ce0705f883a84953179dbd1d6099d0822f6a008bc323110a2d1ca7ee3edc81b50ccceb42dfbf79ded
SHA1 hash:	42fee0065c6ae5e7496e04e49fe345c673debbc1
MD5 hash:	cc4f5e25d48bbb315b6076273eb55a37
humanhash:	solar-uniform-river-kentucky
File name:	cc4f5e25d48bbb315b6076273eb55a37.exe
Download:	download sample
Signature	Heodo Create hunting rule
File size:	778'240 bytes
First seen:	2020-05-11 12:55:53 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	e41c4e12dfebb13ba7efc6ed1ccf4ce1 (2 x Heodo)
ssdeep	12288:U0vY211ECZELJyOoF11PS2MaLzkfcszZogbH20aECaw:zpEC6LYOob5NFz7sieVCa
Threatray	173 similar samples on MalwareBazaar
TLSH	ABF4B02775D2C47BC2B320B24E186B6A72F6FD210B3A4AC31B95071D1E7A9C15E37366
Reporter	abuse_ch
Tags:	Emotet exe Heodo

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Emotet

Link:

https://www.capesandbox.com/analysis/4802/

Detection(s):

PUA.Win.Packer.Armadillo-65

Gathering data

Threat name:

Win32.Trojan.Emotet

Status:

Malicious

First seen:

2020-05-11 12:33:29 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

26 of 31 (83.87%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=iwrkx5y2n4ird4x7nobqhlajutfqzizy7hbyowhxvgzl6qcdfeeq._file

Verdict:

malicious

Label(s):

emotet

Result

Malware family:

emotet

Score:

10/10

Tags:

family:emotet botnet:epoch1 banker trojan

Link:

https://tria.ge/reports/201109-z5nfmme9l6/

Behaviour

Suspicious behavior: EmotetMutantsSpam

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Views/modifies file attributes

Emotet

Malware Config

C2 Extraction:

200.119.11.118:443
103.83.81.141:8080
190.229.148.144:80
77.90.136.129:8080
45.161.242.102:80
47.150.248.161:80
177.72.13.80:80
177.188.121.26:443
189.1.185.248:80
221.133.46.86:443
177.38.15.151:80
5.196.35.138:7080
77.55.211.77:8080
118.69.71.14:80
113.190.254.245:80
204.225.249.100:7080
185.94.252.12:80
187.162.248.237:80
12.162.84.2:8080
114.109.179.60:80
50.28.51.143:8080
185.94.252.27:443
72.47.248.48:7080
177.66.190.130:80
93.147.157.195:80
190.17.195.202:80
46.28.111.142:7080
70.32.115.157:8080
73.239.11.159:80
170.81.48.2:80
2.47.112.152:80
46.214.11.172:80
177.103.159.44:80
143.0.87.101:80
192.241.146.84:8080
91.83.93.124:7080
202.62.39.111:80
212.71.237.140:8080
104.131.41.185:8080
185.94.252.13:443
113.161.147.51:80
37.187.6.63:8080
187.51.47.26:80
149.62.173.247:8080
110.143.8.89:80
201.213.32.59:80
83.169.21.32:7080
177.139.131.143:443
94.176.234.118:443
186.188.222.3:80
93.147.137.162:80
186.3.232.68:80
82.196.15.205:8080
190.57.130.142:443
104.236.161.64:8080
68.183.190.199:8080
111.67.12.221:8080
91.236.4.234:443
59.120.5.154:80
190.181.235.46:80
172.104.169.32:8080
65.24.85.214:80
177.73.3.204:80
201.91.28.210:80
186.33.141.88:80
200.69.224.73:80
181.10.204.106:80
61.92.159.208:8080
200.126.237.113:80
181.31.211.181:80
175.114.178.83:443
152.231.89.226:80
203.25.159.3:8080
70.32.84.74:8080
192.241.143.52:8080
186.68.48.204:443
164.77.130.222:80
104.131.103.37:8080
178.79.163.131:8080
203.122.18.234:8080

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Cobalt_functions Create hunting rule
Author:	@j0sm1
Description:	Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

Rule name:	win_emotet_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator