MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5fac6cd31ff0f16528342db837798bb0767bd8a6747177492df2bf74d4c51dab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5fac6cd31ff0f16528342db837798bb0767bd8a6747177492df2bf74d4c51dab
SHA3-384 hash: d61d7429bbec7fdc9a2f2e6b6ce8c7b9c1a4e00cc053b79fb8ed1d00d5c02ed6af4e9db0657c92c02cd32589988e21c3
SHA1 hash: e7fdc397b17bdf875754806362ac3e789361a246
MD5 hash: 56ca13666918d6227702bada9419fcb4
humanhash: earth-yankee-fix-princess
File name:SecuriteInfo.com.Win32.DH_gVE1gjgD.22048.23183
Download: download sample
Signature Emotet
Create hunting rule
File size:571'392 bytes
First seen:2020-04-24 13:41:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 64edfb43d5cf5c8f631d7353335d2a80 (3 x Emotet)
ssdeep 12288:7zj3W8b8dg7sHMPm7qWyhQx1ulMp9spbMT0akdlD3wneJMHb:7zK8b8KyqW6CspQTNkdBAnek
Threatray 38 similar samples on MalwareBazaar
TLSH 81C4CF11B696E032E4A101714F78EBB6546CBA254B7109DB73C44E7E4EB03C3AA35F6B
Reporter SecuriteInfoCom
Tags:Emotet

Intelligence

File Origin
# of uploads :
1
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

SecuriteInfo.com.Win32.DH_gVE1gjgD.22048.23183.UNOFFICIAL
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Johnnie
Create hunting rule
Status:
Malicious
First seen:
2020-04-24 06:55:13 UTC
File Type:
PE (Exe)
Extracted files:
29
AV detection:
27 of 31 (87.10%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
emotet
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
479e4ead60a894c73202faba0c9ebf5762fee19e7d3ceed4af66cf710bb83b05
Emotet
521433d5e57056d9453e33f572757e5dde402d9b97b4edee522bff7dcaea579e
Emotet
5a69c76991e5c1b6d2f46d9a300fa8902d3ff6fb6afcebeee91697743b0542b7
Emotet
6f090c1a513f10aaf8d51f740de15f53bd2660ea2b48179dfbb9fd84bd7df807
Emotet
7e17e9de1f6643f57b6cda4a921b025a9caf5689728b0af2f653887f41e2c318
Emotet
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
Emotet
a549cf015c44ad2571cacf2820869e00b44fab9ca95b002a7bdc27e7848e533f
Emotet
a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc
Emotet
b841402ba599fba5dc3b4775aa53e26445a49c4d7df1fa8e64d26c4cc16c5083
Emotet
d33a08e10593effc2e5bd990a67c3759bfdeebf6d91ec5055d4bd4ad5fa07b43
Emotet
+ 28 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Emotet

Executable exe 5fac6cd31ff0f16528342db837798bb0767bd8a6747177492df2bf74d4c51dab

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/350572/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::AllocateAndInitializeSid
ADVAPI32.dll::FreeSid
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::CheckTokenMembership
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExA
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
WINHTTP.dll::WinHttpCloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetCommandLineW
KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WinExec
KERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileA
KERNEL32.dll::CreateFileW
KERNEL32.dll::GetTempPathA
WIN_HTTP_APIUses HTTP servicesWINHTTP.dll::WinHttpAddRequestHeaders
WINHTTP.dll::WinHttpConnect
WINHTTP.dll::WinHttpGetIEProxyConfigForCurrentUser
WINHTTP.dll::WinHttpGetProxyForUrl
WINHTTP.dll::WinHttpOpen
WINHTTP.dll::WinHttpOpenRequest
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegOpenKeyExA
ADVAPI32.dll::RegSetValueExW
ADVAPI32.dll::RegSetValueExA

Comments