MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61b277c90703979b6f26776e18cad637717fb7113ec8fbb277a329621665cfc6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 61b277c90703979b6f26776e18cad637717fb7113ec8fbb277a329621665cfc6
SHA3-384 hash: 26ff118ca4168438332ef6474966ad7342d603c6b5099bbc5e79c6da0e6452518428ae127bd457b7d18f043cfd7b11e2
SHA1 hash: a57536cf45ae58c668c81c148988dc01f12fca8a
MD5 hash: c3cbf156c5db22266260845e91827a45
humanhash: ink-india-blossom-uncle
File name:emotet_e1_61b277c90703979b6f26776e18cad637717fb7113ec8fbb277a329621665cfc6_2020-09-15__103056._doc
Download: download sample
Signature Heodo
Create hunting rule
File size:159'117 bytes
First seen:2020-09-15 10:32:32 UTC
Last seen:2020-09-15 10:32:38 UTC
File type:Word file docx
MIME type:application/msword
ssdeep 1536:gURA+F6URA+Fhrdi1Ir77zOH98Wj2gpngd+a9OxQIY0y+Wbiw:frfrzOH98ipgmxDH7Aiw
TLSH 8AF3950926D1994EF33A8E3027D9AAE91856DCF45D8D40673288BB147737B40E9F1BF8
Reporter Cryptolaemus1
Tags:doc Emotet epoch1 Heodo


Avatar
Cryptolaemus1
Emotet epoch1 doc

Intelligence

File Origin
# of uploads :
5
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
TwinWave.EvilDoc.AutoExecSeparateWays.20200818.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.VB.Trojan.VBA.Agent.BHH.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.WelcomeBackEmotetThatsWhyTheyCallItWindowPain.2020717.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.EmotetCROCryLittleSister.20200720.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.EmotetARCROClubbedToDeathKurayamino.20200904.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Using the Windows Management Instrumentation requests
Creating a process with a hidden window
DNS request
Creating a file
Creating a process from a recently created file
Moving a file to the Windows subdirectory
Creating a service
Connection attempt
Sending an HTTP POST request
Deleting a recently created file
Possible injection to a system process
Enabling autorun for a service
Launching a process by exploiting the app vulnerability
Sending an HTTP GET request to an infection source
Detection:
emotet
Create hunting rule
Link:
https://mwdb.cert.pl/sample/61b277c90703979b6f26776e18cad637717fb7113ec8fbb277a329621665cfc6/
Threat name:
Document-Word.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2020-09-15 10:34:07 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mgzhpsihaolzw3zgo5xbrswwg5yx7nyrh3epxmtxumuweftfz7da._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
macro
Link:
https://tria.ge/reports/200915-ac77rmrhxe/
Behaviour
Suspicious Office macro
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Emotet
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/61b277c90703979b6f26776e18cad637717fb7113ec8fbb277a329621665cfc6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Heodo

Word file docx 61b277c90703979b6f26776e18cad637717fb7113ec8fbb277a329621665cfc6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/504792/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/499267/
  
URLhaus
https://urlhaus.abuse.ch/url/503987/
  
URLhaus
https://urlhaus.abuse.ch/url/501299/
  
URLhaus
https://urlhaus.abuse.ch/url/504442/
  
URLhaus
https://urlhaus.abuse.ch/url/501259/
  
URLhaus
https://urlhaus.abuse.ch/url/503041/
  
URLhaus
https://urlhaus.abuse.ch/url/502147/
  
URLhaus
https://urlhaus.abuse.ch/url/500287/
  
URLhaus
https://urlhaus.abuse.ch/url/500059/
  
URLhaus
https://urlhaus.abuse.ch/url/501275/
  
URLhaus
https://urlhaus.abuse.ch/url/497057/

Comments