MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b28154f980d8fec3b4a0367c107f3966f9358bd27ca20385d3e1422a61bcf67. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 16


Intelligence 16 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4b28154f980d8fec3b4a0367c107f3966f9358bd27ca20385d3e1422a61bcf67
SHA3-384 hash: 4ea384085bd0a2ff253b509a65e55c352c20398e8f0cf1022dcf4b5af568ccdf1f9c87a3b91e8da05c87727cf598f135
SHA1 hash: 4b2509eb52fab499741a2eab115c789d7d8d489c
MD5 hash: 2421e3c9e8438dcac0ff6447f86e36f9
humanhash: south-queen-vermont-equal
File name:4b2509eb52fab499741a2eab115c789d7d8d489c
Download: download sample
Signature Heodo
Create hunting rule
File size:557'056 bytes
First seen:2022-11-30 09:05:03 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2f810b8ed7f9f08ed077c2c647e4f113 (1 x Heodo, 1 x TrickBot)
ssdeep 12288:vGLDDmvjUmzaOopzIYoz1Wuh1o7rxi3IrtKZ:YDqj8OoaYCYuUr0SY
Threatray 117 similar samples on MalwareBazaar
TLSH T120C49E1B3AE0C037C2F291725EC67B3AB6B2AD900D37464327D54F1E4E369919B2B176
TrID 40.5% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
17.0% (.SCR) Windows screen saver (13097/50/3)
13.6% (.EXE) Win64 Executable (generic) (10523/12/4)
8.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
dhash icon 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer)
Reporter EstisRemiel
Tags:Emotet exe Heodo

Intelligence

File Origin
# of uploads :
1
# of downloads :
232
Origin country :
HK HK
Vendor Threat Intelligence
Malware family:
emotet
Create hunting rule
ID:
1
File name:
0299500-102019-03464473.doc
Verdict:
Malicious activity
Analysis date:
2019-10-14 14:05:50 UTC
Tags:
macros macros-on-open generated-doc loader emotet emotet-doc
Link:
https://app.any.run/tasks/409cef0e-b9f6-4d98-b879-0f19323a7f9d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Emotet
Create hunting rule
Link:
https://www.capesandbox.com/analysis/339921/
Detection(s):
Win.Trojan.Emotet-7337462-0
Create hunting rule

Win.Trojan.Emotet-7339736-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a service
Launching a service
Forced system process termination
Adding an access-denied ACE
Moving of the original file
Enabling autorun for a service
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
greyware keylogger shell32.dll
Link:
https://www.filescan.io/uploads/63871cfb5363773888661f4a/reports/3b74d46d-2746-47fd-a123-71d2eee1fb88/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Emotet
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fc9b9936-f02b-40da-82c8-b146181500f3
Result
Threat name:
Emotet
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1123753
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Changes security center settings (notifications, updates, antivirus, firewall)
Drops executables to the windows directory (C:\Windows) and starts them
Hides that the sample has been downloaded from the Internet (zone.identifier)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Query firmware table information (likely to detect VMs)
Yara detected Emotet
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 756480 Sample: FLsA4qYz0G.exe Startdate: 30/11/2022 Architecture: WINDOWS Score: 100 28 64.188.132.144 ZITOMEDIA611US United States 2->28 30 192.188.132.144 YORKTEL-ASUS United Kingdom 2->30 32 34 other IPs or domains 2->32 42 Malicious sample detected (through community Yara rule) 2->42 44 Antivirus detection for URL or domain 2->44 46 Antivirus / Scanner detection for submitted sample 2->46 48 3 other signatures 2->48 8 svchost.exe 2->8         started        11 msptermwubi.exe 2->11         started        13 FLsA4qYz0G.exe 2->13         started        15 13 other processes 2->15 signatures3 process4 dnsIp5 52 Changes security center settings (notifications, updates, antivirus, firewall) 8->52 18 MpCmdRun.exe 1 8->18         started        54 Drops executables to the windows directory (C:\Windows) and starts them 11->54 20 msptermwubi.exe 15 11->20         started        23 FLsA4qYz0G.exe 1 13->23         started        40 192.168.2.1 unknown unknown 15->40 56 Query firmware table information (likely to detect VMs) 15->56 signatures6 process7 dnsIp8 26 conhost.exe 18->26         started        34 110.36.234.146, 80 WATEEN-IMS-PK-AS-APNationalWiMAXIMSenvironmentPK Pakistan 20->34 36 191.82.16.60, 80 TelefonicadeArgentinaAR Argentina 20->36 38 2 other IPs or domains 20->38 50 Hides that the sample has been downloaded from the Internet (zone.identifier) 23->50 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4b28154f980d8fec3b4a0367c107f3966f9358bd27ca20385d3e1422a61bcf67/
Threat name:
Win32.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2019-10-14 12:02:58 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jmubkt4ybwh6yo2kant4cb7tszxzgwf5e7fcaoc5hykcfjq3z5tq._file
Verdict:
malicious
Label(s):
emotet
Create hunting rule
Similar samples:
00dce1e20b8469aecc0938f2ddec66b813c12dedb50b0b67c3e6a3032c3ca0b0
Heodo
0cd90a4f464272425d51dbe92ec97c7950c5defff4ea4090521252adffb19ae2
Heodo
1276973fa6c5aa057ce9e7d60ae51e398cf41871b28d7fc9304c12d50a1fa938
Heodo
21aeb4f29c26344b4a2b66c91b1b20438fe327b50a13436d9813d23b6e009a61
Heodo
3aac8f227c9dcabb63cbd7fc2af800d708638033c0b87930875f13d9ec30b5c1
Heodo
3ba51d1b588084107221072d294bf51f863dac279d940254c420f3140caf02c5
Heodo
562aff5844aa5c4b66f909596f8aaca86180ce3df0a7397792d627e123cbf5ac
Heodo
90660a8cbf6404338b401411f33a20512ef76e319cc2764de42e12df80a003c9
Heodo
f706952df88e270262ad1acf11b8a99fe76bb623305b893b46cd9d86ac95e4c4
Heodo
f8a1cfb8fc8b6732bf953c16880f0ffe76c865e6480d84c4624c775c5b82fd1f
Heodo
+ 107 additional samples on MalwareBazaar
Result
Malware family:
emotet
Create hunting rule
Score:
  10/10
Tags:
family:emotet botnet:epoch1 banker trojan
Link:
https://tria.ge/reports/221130-k1622saa3v/
Behaviour
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in System32 directory
Unexpected DNS network traffic destination
Emotet
Malware Config
C2 Extraction:
110.36.234.146:80
191.82.16.60:80
91.83.93.105:8080
216.98.148.181:8080
68.183.190.199:8080
190.230.60.129:80
183.82.97.25:80
114.79.134.129:443
89.188.124.145:443
178.79.163.131:8080
76.69.29.42:80
87.106.77.40:7080
178.249.187.151:8080
62.75.143.100:7080
201.163.74.202:443
62.75.160.178:8080
181.188.149.134:80
186.0.95.172:80
217.199.160.224:8080
203.25.159.3:8080
189.160.49.234:8443
190.104.253.234:990
71.244.60.230:7080
159.203.204.126:8080
71.244.60.231:7080
142.93.82.57:8080
46.41.151.103:8080
138.68.106.4:7080
5.1.86.195:8080
149.62.173.247:8080
170.84.133.72:7080
190.230.60.129:8080
190.97.30.167:990
190.85.152.186:8080
200.58.171.51:80
51.15.8.192:8080
190.158.19.141:80
91.83.93.124:7080
139.5.237.27:443
123.168.4.66:22
81.169.140.14:443
187.188.166.192:80
212.71.237.140:8080
186.1.41.111:443
77.245.101.134:8080
181.29.101.13:8080
181.44.166.242:80
185.86.148.222:8080
86.42.166.147:80
190.221.50.210:8080
94.183.71.206:7080
181.36.42.205:443
170.84.133.72:8443
68.183.170.114:8080
79.129.0.173:8080
184.69.214.94:20
189.180.243.255:8080
200.57.102.71:8443
109.104.79.48:8080
185.187.198.10:8080
80.85.87.122:8080
181.143.101.18:8080
119.59.124.163:8080
46.163.144.228:80
50.28.51.143:8080
88.250.223.190:8080
190.38.14.52:80
119.159.150.176:443
5.77.13.70:80
200.51.94.251:143
82.196.15.205:8080
201.199.93.30:443
5.196.35.138:7080
46.28.111.142:7080
125.99.61.162:7080
189.166.68.89:443
151.80.142.33:80
79.143.182.254:8080
119.92.51.40:8080
46.101.212.195:8080
46.29.183.211:8080
91.205.215.57:7080
190.10.194.42:8080
77.55.211.77:8080
109.169.86.13:8080
190.1.37.125:443
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/bfe4884e-5d7b-4915-bc51-e3a821e2dfc0
Unpacked files
SH256 hash:
d8c052964847a753240e7980fa23c7ea6bd4c68fa9fcdea2eea4ddf83378bfcf
MD5 hash:
75789be1a0cf5b09812de65d704410fa
SHA1 hash:
09d4fbc68c82d10590146e5b9312f90e339a8750
Detections:
win_emotet_auto
Create hunting rule
win_emotet_a2
Create hunting rule
Link:
https://www.unpac.me/results/c5b48c8d-8d78-416f-8239-b3b8f6862aba/
Parent samples :
00dce1e20b8469aecc0938f2ddec66b813c12dedb50b0b67c3e6a3032c3ca0b0
4b28154f980d8fec3b4a0367c107f3966f9358bd27ca20385d3e1422a61bcf67
c725c4069b6bc088bd634654961e60ed09c5bb1aa35b214b6a86a86dd63da8e6
0a91ca038be80280f9e9e300dafd4490be9269d1ad7649f102aa5c58b7d7a9db
9226a5552470fc7a251c1aaf5ca873e15c787cd9f7266e3d3977c8028e4036ce
6a6904fe007845787df332920919c2a1f968de70f288a29a410f3e46da5501bd
SH256 hash:
4b28154f980d8fec3b4a0367c107f3966f9358bd27ca20385d3e1422a61bcf67
MD5 hash:
2421e3c9e8438dcac0ff6447f86e36f9
SHA1 hash:
4b2509eb52fab499741a2eab115c789d7d8d489c
Link:
https://www.unpac.me/results/c5b48c8d-8d78-416f-8239-b3b8f6862aba/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4b28154f980d8fec3b4a0367c107f3966f9358bd27ca20385d3e1422a61bcf67

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Heodo

Executable exe 4b28154f980d8fec3b4a0367c107f3966f9358bd27ca20385d3e1422a61bcf67

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/339921/
  
URLhaus
https://urlhaus.abuse.ch/url/244526/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/244530/
  
URLhaus
https://urlhaus.abuse.ch/url/244527/
  
URLhaus
https://urlhaus.abuse.ch/url/244529/
  
URLhaus
https://urlhaus.abuse.ch/url/244528/

Comments