MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 59c3bb00017dd3bb1abd4d42d9a50df24fcd320bacf5335d1c030b772dc796c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Add tag Delete this sample Report a False Positive

SHA256 hash: 59c3bb00017dd3bb1abd4d42d9a50df24fcd320bacf5335d1c030b772dc796c5
SHA3-384 hash: edfd3abc2b05497b6db3c0c3a58983a4bdf47317031693c5d1588ed6d39125fc3b9e713faa1c1a10132e224d76c1b2ed
SHA1 hash: 32bcf8bbf7a5a3e88f4025179f4be9445b8e7ec8
MD5 hash: 52b94921d9e57a2009fb0c562aab25bc
humanhash: double-comet-mirror-ten
File name:emotet-sample-with-server-sided-code.zip
Download: download sample
Signature n/a
File size:562'836 bytes
First seen:2020-03-19 18:51:05 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:vd1Ja9NiT73FVqdah1wYnFPAVIsHJm0q9H9Klkac7h:11JSNu3eEh1widsprq9kI7h
TLSH E1C423D0F6B4498F9AD9D2B6279C7B07A782D078712514CA95A3051478C0EEFD3E2EF1
Reporter @Libranalysis
Tags:deobfuscated Emotet macro php server sided code


Twitter
@Libranalysis
Emotet stages (obfuscated and deobfuscated), together with server sided PHP dropper code. A detailed analysis can be found here: https://maxkersten.nl/binary-analysis-course/malware-analysis/emotet-droppers/

Intelligence

File Origin
# of uploads :
1
# of downloads :
142
Origin country :
NL NL
Mail intelligence
No data
Vendor Threat Intelligence
Detection(s):
Doc.Malware.Outbreak-6923440-0
Create hunting rule

Doc.Malware.Outbreak-6923442-0
Create hunting rule

Doc.Malware.Outbreak-6923441-0
Create hunting rule

Sanesecurity.Malware.24819.MacroHeurGen.Hp.UNOFFICIAL
Create hunting rule

Doc.Dropper.Agent-6842045-0
Create hunting rule

SecuriteInfo.com.PHP.Obfus-42.UNOFFICIAL
Create hunting rule

Php.Malware.Agent-6779621-0
Create hunting rule

SecuriteInfo.com.PUA.Base64EXE-2.UNOFFICIAL
Create hunting rule

Win.Malware.Emotet-6856567-0
Create hunting rule

Win.Malware.Emotet-6858871-0
Create hunting rule

Gathering data
Threat name:
Document-Word.Trojan.Obfuse
Create hunting rule
Status:
Malicious
First seen:
2019-03-08 08:36:40 UTC
File Type:
Binary (Archive)
Extracted files:
41
AV detection:
33 of 42 (78.57%)
Threat level:
  2/5
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/59c3bb00017dd3bb1abd4d42d9a50df24fcd320bacf5335d1c030b772dc796c5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments