MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5481eca24911b03018ce88cbe69e2a4380da4ad6d050a3939eb2fd22121524f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 13


Intelligence 13 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5481eca24911b03018ce88cbe69e2a4380da4ad6d050a3939eb2fd22121524f8
SHA3-384 hash: 5c6757518e161acddb880cdecd3f4d6b9a920d462ec3e79966cdca7b33dc133f27169ed7f8c2b8e17fc1515f64ec50fd
SHA1 hash: cc48469917b20736db4d7961c0e207800362299d
MD5 hash: fc434a3cb98dadf12b1470fa7284fc85
humanhash: fifteen-mars-lamp-cola
File name:mlbwnwvwxp.bic
Download: download sample
Signature Heodo
Create hunting rule
File size:1'253'888 bytes
First seen:2021-12-24 13:34:23 UTC
Last seen:2021-12-24 13:35:12 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 6e16afd0d7990d33ac75371bcceecbc8 (44 x Heodo)
ssdeep 24576:JbYRleg4H/qZHeK+dVxodFx2mi8WJhFwmuK/DHvb1MrzM+SU5L5tj112jGLF2eos:0UQH1dFx2mi8kwybqzM8L5tj112jGLFh
Threatray 365 similar samples on MalwareBazaar
TLSH T1A545BD0078C2C0B6F62B2479053AB3690FEE65201720CEEFDB88DDB56F75DC2593665A
Reporter Anonymous
Tags:dll Emotet Heodo

Intelligence

File Origin
# of uploads :
2
# of downloads :
179
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Emotet
Create hunting rule
Link:
https://www.capesandbox.com/analysis/216169/
Detection(s):
Win.Trojan.Generic-9917122-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
emotet greyware
Link:
https://www.filescan.io/uploads/61c5cc88ec6c6c14a9ef3a10/reports/ab8f69a3-100e-443d-a638-0bc6d4024542/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Emotet
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/73d34f90-941d-4953-9c47-dfc2881fc6b1
Result
Threat name:
Emotet
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/912471
Signature
C2 URLs / IPs found in malware configuration
Changes security center settings (notifications, updates, antivirus, firewall)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Call by Ordinal
System process connects to network (likely due to code injection or exploit)
Yara detected Emotet
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 544949 Sample: mlbwnwvwxp.dll Startdate: 24/12/2021 Architecture: WINDOWS Score: 96 48 162.214.50.39 UNIFIEDLAYER-AS-1US United States 2->48 50 203.114.109.124 TOT-LLI-AS-APTOTPublicCompanyLimitedTH Thailand 2->50 52 33 other IPs or domains 2->52 58 Multi AV Scanner detection for domain / URL 2->58 60 Found malware configuration 2->60 62 Multi AV Scanner detection for submitted file 2->62 64 3 other signatures 2->64 9 loaddll32.exe 1 2->9         started        11 svchost.exe 2->11         started        14 svchost.exe 2->14         started        16 8 other processes 2->16 signatures3 process4 signatures5 18 rundll32.exe 2 9->18         started        22 regsvr32.exe 9->22         started        24 cmd.exe 1 9->24         started        28 2 other processes 9->28 68 Changes security center settings (notifications, updates, antivirus, firewall) 11->68 26 MpCmdRun.exe 1 11->26         started        process6 dnsIp7 54 192.168.2.1 unknown unknown 18->54 66 Hides that the sample has been downloaded from the Internet (zone.identifier) 18->66 30 rundll32.exe 18->30         started        32 rundll32.exe 22->32         started        34 backgroundTaskHost.exe 22->34         started        36 rundll32.exe 24->36         started        38 conhost.exe 26->38         started        40 rundll32.exe 28->40         started        signatures8 process9 process10 42 rundll32.exe 30->42         started        46 rundll32.exe 36->46         started        dnsIp11 56 144.217.91.150, 443, 49747 OVHFR Canada 42->56 70 System process connects to network (likely due to code injection or exploit) 42->70 signatures12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5481eca24911b03018ce88cbe69e2a4380da4ad6d050a3939eb2fd22121524f8/
Threat name:
Win32.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2021-12-24 13:35:10 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ksa6zisjcgydaggordf6nhrkioanusww2bikhe46wl6seeqvet4a._file
Verdict:
malicious
Label(s):
emotet
Create hunting rule
Similar samples:
2db9ce3901b75309b5669e0e94c8cfd2c93f9f4d5c6b1c023bfa0ac1806e0a87
Heodo
39c0cdc49c42cdbdba33dda54cc2efb705dec573d81234839ee106e02f3d6aa1
Heodo
5a069746996891792a8dca2d0d1296ed8153a6500cbde1f145924eb4ea3de3b1
Heodo
627514179c485caf59499a86f96a39eff2b3c8b9592354d9044e8ced8a89af23
Heodo
824a3f0277b943e71033fce00144f02f387109b820629795a6004b19b78504b4
Heodo
9dd4052fc27960c70e03bcbd521c7b832f5617da0b69821e9c06a174380339c0
Heodo
a84e754252e4a6e668881039eecad1adcb502f398d91a36ed0c2eaa6ba808a3f
Heodo
a93f9ee50c0d705ffe8f402e27c1c8018dc239f6ea8f4dd435e8ffe3a7132c3a
Heodo
b5055179d3096337ee8a59d012b693b98a06f1b74557aae4755d88e8f9c283bd
Heodo
dafcf4cefffd38e43e04f7d536f01e1794bf1ef00842bc27efbd40fb039fb8c4
Heodo
+ 355 additional samples on MalwareBazaar
Result
Malware family:
emotet
Create hunting rule
Score:
  10/10
Tags:
family:emotet botnet:epoch4 banker trojan
Link:
https://tria.ge/reports/211224-qvnw6secc2/
Behaviour
Suspicious use of WriteProcessMemory
Emotet
Malware Config
C2 Extraction:
144.217.91.150:443
51.38.71.0:443
212.237.56.116:7080
79.172.212.216:8080
178.79.147.66:8080
138.185.72.26:8080
192.254.71.210:443
178.63.25.185:443
195.154.133.20:443
45.118.135.203:7080
81.0.236.90:443
107.182.225.142:8080
162.214.50.39:7080
50.116.54.215:443
203.114.109.124:443
45.118.115.99:8080
216.158.226.206:443
104.168.155.129:8080
110.232.117.186:8080
176.104.106.96:8080
46.55.222.11:443
51.68.175.8:8080
207.38.84.195:8080
58.227.42.236:80
45.176.232.124:443
104.251.214.46:8080
103.8.26.102:8080
45.142.114.231:8080
217.182.143.207:443
41.76.108.46:8080
212.237.5.209:443
103.8.26.103:8080
212.237.17.99:8080
173.212.193.249:8080
158.69.222.101:443
103.75.201.2:443
Unpacked files
SH256 hash:
e5725b033e0ab4d5262c8d58d0b7cdbd1448e349ca1baa4d21352341f91c02c1
MD5 hash:
4f0b12d9484b36952da87aada6d5380c
SHA1 hash:
c5e91ebce8a89b85b28fe30ef43a10a5c5178147
Detections:
win_emotet_a2
Create hunting rule
win_emotet_auto
Create hunting rule
Link:
https://www.unpac.me/results/4c8f1582-ef3c-4ea7-a631-789446248374/
Parent samples :
70c1288e9d31fc88843baab3f22646ffa7a168dfccae59114efa4e313ed93342
dafcf4cefffd38e43e04f7d536f01e1794bf1ef00842bc27efbd40fb039fb8c4
2db9ce3901b75309b5669e0e94c8cfd2c93f9f4d5c6b1c023bfa0ac1806e0a87
a93f9ee50c0d705ffe8f402e27c1c8018dc239f6ea8f4dd435e8ffe3a7132c3a
9dd4052fc27960c70e03bcbd521c7b832f5617da0b69821e9c06a174380339c0
caab57f5666791e06569dec2525a73c05093f802ff9fcb63217d617885934b31
b5055179d3096337ee8a59d012b693b98a06f1b74557aae4755d88e8f9c283bd
5481eca24911b03018ce88cbe69e2a4380da4ad6d050a3939eb2fd22121524f8
c521fe1757f1650ee0ebee5f40803b472645be5d079923ee31e9d06501f8b150
ae265469e957237bdefc756052fdf16a57b327df1c0e297af060a782151b0eb7
3ef54d0b4ddae929dcea58be681402552563083a84ff4c71bd4ee21f4e6869ad
5656363529527938e25ed8f39e568b5ed241a25e124b4cdbd9170d103a4a5dd0
8784798dbddfb7c712b0336bdf3d7dd2c03c4e0f0fe44c51783321dbb6fe0cd3
761f99ee9f3efb8fc11aff822ee30b8f6d7db09f4c38f4d60670c601307517d9
4fbbc63b55175875a2b55c5881fa93e51af5fd6bcd9c124a774635902f437717
faea97bf475f57afbea3768e9e11ec5161c6b66456eba7461ae649a38d6dc77b
1fa8c05f509df70da3ca7f1834df62435da3bb5e0f3b8f563b103878ed7bce7e
2e1f12f551f566a963772190fedde695dc87b4fd54e7ca0a40c46dfdb6621cc4
636d4994c59fd2b09d078c5bae3513c22b59e4794d71281c17a7edc33b78021a
096a65b7271696f2cea35b736edd00201427c4be1bcf1f518a4dc8589d612725
1652d4bbec44afc20fd2a289c061fc130e43003bd35c65ae7b026c7091ca0e1c
945d5d4be4e003c4ca685521d7d22f2c35508c9ee8d8c18e4d8a6db14f4ec121
898b9eddb7ad4aa2623c50eb79a25d49262b6230cf1713c825553110386fcf75
SH256 hash:
5481eca24911b03018ce88cbe69e2a4380da4ad6d050a3939eb2fd22121524f8
MD5 hash:
fc434a3cb98dadf12b1470fa7284fc85
SHA1 hash:
cc48469917b20736db4d7961c0e207800362299d
Link:
https://www.unpac.me/results/4c8f1582-ef3c-4ea7-a631-789446248374/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5481eca24911b03018ce88cbe69e2a4380da4ad6d050a3939eb2fd22121524f8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Emotet
Create hunting rule
Author:kevoreilly
Description:Emotet Payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SilentBuilder

Excel file xlsx 5bb626d65f16f3befd6929af097b9f8513a435662959c67645414a795777208a

Heodo

DLL dll 5481eca24911b03018ce88cbe69e2a4380da4ad6d050a3939eb2fd22121524f8

(this sample)

  
Dropped by
SHA256 5bb626d65f16f3befd6929af097b9f8513a435662959c67645414a795777208a
Cape
Cape
https://www.capesandbox.com/analysis/216169/
  
URLhaus
https://urlhaus.abuse.ch/url/1915439/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1915429/
  
URLhaus
https://urlhaus.abuse.ch/url/1915268/
  
URLhaus
https://urlhaus.abuse.ch/url/1914775/
  
URLhaus
https://urlhaus.abuse.ch/url/1914223/
  
URLhaus
https://urlhaus.abuse.ch/url/1914091/
  
URLhaus
https://urlhaus.abuse.ch/url/1915160/
  
URLhaus
https://urlhaus.abuse.ch/url/1913559/
  
URLhaus
https://urlhaus.abuse.ch/url/1915736/

Comments