MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61ad8ff7b576e3934e9a31555769f42d7d515f8a618aee4e3898040a7c0bdb55. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 61ad8ff7b576e3934e9a31555769f42d7d515f8a618aee4e3898040a7c0bdb55
SHA3-384 hash: 5ff13dd2c366cb3b0563afae7e7ca358883a1a2a55b87a11a9109564f3730fbf3b6c13d25f4e2583f81421fa0420e806
SHA1 hash: ba308da10cb40732048c908247b1782f6c5ba3eb
MD5 hash: d5f75fc47d25aad6dbd201b8493dd5e6
humanhash: april-grey-potato-grey
File name:emotet_exe_e4_61ad8ff7b576e3934e9a31555769f42d7d515f8a618aee4e3898040a7c0bdb55_2022-02-13__053544.exe
Download: download sample
Signature Heodo
Create hunting rule
File size:347'279 bytes
First seen:2022-02-13 05:35:48 UTC
Last seen:2022-02-13 07:54:22 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash c0eaca862e71892f0b09074d92f8955f (31 x Heodo)
ssdeep 6144:3QfYaJlKdMDan9+2VhqOWOLt5ZZnB9iHC4CqhAMQvYj:3Qw+CM2n9+6qsRlSLhp
Threatray 593 similar samples on MalwareBazaar
TLSH T14374BF40F2DA8476D6B72B34257247266A7AF9127F38C38FB3548989DE31780DE3471A
Reporter Cryptolaemus1
Tags:dll Emotet epoch4 exe Heodo


Avatar
Cryptolaemus1
Emotet epoch4 exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
224
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/241139/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.38947404.4014.5176.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
DNS request
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
greyware overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/620898c745ddfa2e18c744d4/reports/f72cb25a-64ec-477a-9679-9eaa2e34240b/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/6b831179-c892-4b38-9a36-f775295c023f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/61ad8ff7b576e3934e9a31555769f42d7d515f8a618aee4e3898040a7c0bdb55/
Threat name:
Win32.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2022-02-13 05:36:13 UTC
File Type:
PE (Dll)
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mgwy755vo3rzgtu2gfkvo2pufv6vcx4kmgfo4trytacau7al3nkq._file
Verdict:
malicious
Similar samples:
2aa088e9b8311f778e4b104efee3913440c05e7f93f1a0e0a37bdf4e586abd68
Heodo
2c1cc77ee02716f0f1836e6a37b274ec198a8c51f55aa8d49bc0e7ad3de8f72f
Heodo
48d5ca70144fa07660310827b5ba6b61df16bdd8d1c9d6a528a0680676b1021f
Heodo
7c2a028c67471b8fe9f91d38c4ccca8f7dd3e2d7157a16b8dc414923d0ce20b0
Heodo
9d40ae0439ddc594b2cf64e21ad0fdea9bb440524298e3a6bcfcc1fb417f1ed2
Heodo
bad1092ccbc6a18880276cb8ab6bd8a6bd44f82a0f94a1bceac1e15b7e6778ae
Heodo
bb78c36647f7d02e1cc6bbc90cb439aaab9181fc0bafa1d40fab24ae6cf31fad
Heodo
c76675281cb334967b76f94883a1a08f9d239c41124dc8afe0d506c1c6c22f88
Heodo
cc27f5e94e19e21276fa4318bec89ab24f0f5dfac182bf7815e4603761a07919
Heodo
f48061a7fd4f9f584648ff59b45ef310a8ac7135cf4fcc278ebbb81a31cb5632
Heodo
+ 583 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  4/10
Tags:
n/a
Link:
https://tria.ge/reports/220213-gal3eagcbr/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Unpacked files
SH256 hash:
61ad8ff7b576e3934e9a31555769f42d7d515f8a618aee4e3898040a7c0bdb55
MD5 hash:
d5f75fc47d25aad6dbd201b8493dd5e6
SHA1 hash:
ba308da10cb40732048c908247b1782f6c5ba3eb
Link:
https://www.unpac.me/results/9611236a-c0d9-4cc0-b6d4-41faa6f59dcd/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exec_macros
Create hunting rule
Author:ddvvmmzz
Description:exec macros

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/241139/

Comments