MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 58758c6332283a94cf30d675646e5b3348f97233c2f651b191d1d5a4d1b685a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 3


Intelligence 3 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 58758c6332283a94cf30d675646e5b3348f97233c2f651b191d1d5a4d1b685a1
SHA3-384 hash: 0f5cc8875d7a1e4331d136c572b6e2a9da5425596486f42bf6c3497c2a826f7b9b6017f9238f280e746d9ff3d79c1aa6
SHA1 hash: 97327fb4963c03a9a63dcaae5e505c502a60c953
MD5 hash: 6df58ee7108560767ab16bd89af7e258
humanhash: lamp-emma-ceiling-king
File name:58758c6332283a94cf30d675646e5b3348f97233c2f651b191d1d5a4d1b685a1
Download: download sample
Signature Heodo
Create hunting rule
File size:135'992 bytes
First seen:2020-03-23 16:58:52 UTC
Last seen:2020-03-24 07:42:31 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 31d9be2b06d437d713996f40ba72848e (2 x Heodo)
ssdeep 3072:V0Ecsz3+wLvN0YBn/+kuSmR8+J2xixlxeEHIOH5SJ:mNgmm+P3K+JpxVH5A
TLSH 6BD3C05DA59D891FC86C8B38889BD1BE11F36C20DB300997366C7ACA7C3352BDB53619
Reporter Marco_Ramilli
Tags:Emotet exe Heodo

Code Signing Certificate

Organisation:WBDEVWJTKIIYVHPJIS
Issuer:WBDEVWJTKIIYVHPJIS
Algorithm:sha1WithRSA
Valid from:May 2 20:03:09 2019 GMT
Valid to:Dec 31 23:59:59 2039 GMT
Serial number: 621E926161F7D6A146F8F2376FCBF11F
Intelligence: 2 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 6424C12871CA41A48165F224B42B083B5ACAD3F39178D3C6D046DF77BFEAA368
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
3
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Emotet-6960619-0
Create hunting rule

Win.Malware.Emotet-6960704-0
Create hunting rule

Win.Malware.Emotet-6960707-0
Create hunting rule

Win.Malware.Emotet-6960709-0
Create hunting rule

Win.Trojan.Emotet-7155530-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2019-05-03 08:23:07 UTC
File Type:
PE (Exe)
Extracted files:
23
AV detection:
28 of 30 (93.33%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
emotet
Create hunting rule
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Emotet
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Emotet in memory
Reference:internal research
Rule name:Glasses
Create hunting rule
Author:Seth Hardy
Description:Glasses family
Rule name:GlassesCode
Create hunting rule
Author:Seth Hardy
Description:Glasses code features
Rule name:win_emotet_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Heodo

Executable exe 58758c6332283a94cf30d675646e5b3348f97233c2f651b191d1d5a4d1b685a1

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/189846/
  
URLhaus
https://urlhaus.abuse.ch/url/189715/
  
URLhaus
https://urlhaus.abuse.ch/url/189718/
  
URLhaus
https://urlhaus.abuse.ch/url/189716/
  
URLhaus
https://urlhaus.abuse.ch/url/189615/
  
URLhaus
https://urlhaus.abuse.ch/url/189616/
  
URLhaus
https://urlhaus.abuse.ch/url/189612/
  
URLhaus
https://urlhaus.abuse.ch/url/189613/
  
URLhaus
https://urlhaus.abuse.ch/url/189324/
  
URLhaus
https://urlhaus.abuse.ch/url/189323/
  
URLhaus
https://urlhaus.abuse.ch/url/189196/
  
URLhaus
https://urlhaus.abuse.ch/url/188817/
  
URLhaus
https://urlhaus.abuse.ch/url/188924/
  
URLhaus
https://urlhaus.abuse.ch/url/188486/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
WIN_BASE_APIUses Win Base APIKERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetStartupInfoA
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegOpenKeyA
ADVAPI32.dll::RegQueryValueExA

Comments