MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 642e374a327b3fb444f13e54572a43376e7323edd70c7775ba9d1e2e4d29ad9b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet (aka Heodo)

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	642e374a327b3fb444f13e54572a43376e7323edd70c7775ba9d1e2e4d29ad9b
SHA3-384 hash:	01c0388df45a486cef92eab5cbd55107d34d9d5d2558446c8b5699cc42b86b199b680d85b8321020df5a8af6c408214a
SHA1 hash:	4464ca53e8681a902877977572b1bb58436356fe
MD5 hash:	bbb6aec1c34d4960386f5ec8c83b10ce
humanhash:	william-summer-artist-finch
File name:	emotet_exe_e3_642e374a327b3fb444f13e54572a43376e7323edd70c7775ba9d1e2e4d29ad9b_2020-10-21__101759._exe
Download:	download sample
Signature	Heodo Create hunting rule
File size:	733'184 bytes
First seen:	2020-10-21 10:18:08 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ddff8be21239488981a9a0b131e6cc96 (48 x Heodo)
ssdeep	3072:VWuNy7PvgvkuE318K343DtMrNUcWiAWuNy7PvgvkuPACG363bDdToIXtGgpeveL5:VJNePBuEzh3sJNePBuXTouF4i+4us
TLSH	25F4EB17AA941AC2E066A578CD6F0ECC8415BC9BADB8864F13D1FE2F0CF0741786775A
Reporter	Cryptolaemus1
Tags:	Emotet epoch3 exe Heodo

Cryptolaemus1

Emotet epoch3 exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Emotet

Link:

https://www.capesandbox.com/analysis/74046/

Detection(s):

Win.Malware.Generic-9781033-0

Result

Verdict:

Clean

Maliciousness:

Behaviour

Connection attempt

Sending an HTTP POST request

Sending a UDP request

Creating a window

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/642e374a327b3fb444f13e54572a43376e7323edd70c7775ba9d1e2e4d29ad9b/

Threat name:

Win32.Trojan.Emotet

Status:

Malicious

First seen:

2020-10-21 10:20:19 UTC

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=mqxdosrspm73irhrhzkfoksdg5xhgi7n24gho5n2tupc4tjjvwnq._file

Result

Malware family:

emotet

Score:

10/10

Tags:

trojan banker family:emotet

Link:

https://tria.ge/reports/201021-6l8sq9jgv6/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Emotet Payload

Emotet

Malware Config

C2 Extraction:

194.166.147.143:80
188.226.165.170:8080
188.40.170.197:80
51.38.50.144:8080
85.75.49.113:80
103.229.73.17:8080
190.117.101.56:80
172.96.190.154:8080
223.17.215.76:80
5.2.246.108:80
190.85.46.52:7080
95.76.142.243:80
86.123.55.0:80
103.93.220.182:80
212.198.71.39:80
153.229.219.1:443
139.59.61.215:443
5.79.70.250:8080
190.192.39.136:80
178.33.167.120:8080
50.116.78.109:8080
192.163.221.191:8080
115.79.195.246:80
37.205.9.252:7080
200.243.153.66:80
103.80.51.61:8080
116.202.10.123:8080
121.117.147.153:443
202.29.237.113:8080
36.91.44.183:80
195.201.56.70:8080
221.147.142.214:80
46.32.229.152:8080
73.55.128.120:80
125.200.20.233:80
77.74.78.80:443
91.83.93.103:443
45.239.204.100:80
181.59.59.54:80
94.212.52.40:80
91.213.106.100:8080
123.216.134.52:80
113.193.239.51:443
139.59.12.63:8080
185.63.32.149:80
172.105.78.244:8080
175.103.38.146:80
179.5.118.12:80
198.20.228.9:8080
213.165.178.214:80
180.148.4.130:8080
190.55.186.229:80
172.193.79.237:80
185.80.172.199:80
203.153.216.178:7080
118.33.121.37:80
177.130.51.198:80
162.144.145.58:8080
58.27.215.3:8080
120.51.34.254:80
110.37.224.243:80
126.126.139.26:443
119.92.77.17:80
113.161.148.81:80
79.133.6.236:8080
73.100.19.104:80
60.108.128.186:80
37.46.129.215:8080
42.200.96.63:80
46.105.131.68:8080
109.13.179.195:80
74.208.173.91:8080
203.56.191.129:8080
82.78.179.117:443
185.208.226.142:8080
113.203.238.130:80
190.194.12.132:80
2.58.16.86:8080
47.154.85.229:80
37.187.100.220:7080
188.166.220.180:7080
157.7.164.178:8081
109.206.139.119:80
192.210.217.94:8080
180.21.3.52:80
190.151.5.131:443
192.241.220.183:8080
115.79.59.157:80
116.91.240.96:80
75.127.14.170:8080
180.23.53.200:80
8.4.9.137:8080
91.75.75.46:80
143.95.101.72:8080
41.76.213.144:8080
190.164.135.81:80
41.185.29.128:8080
54.38.143.245:8080
185.142.236.163:443

Unpacked files

SH256 hash:

1847df3883a4b09166cd3df1ade40f2024e484197fcedb36ada3f61885bdb76d

MD5 hash:

b0e5451e1078e723410edfba50651320

SHA1 hash:

5b7758c5faa07a80622166f936d4c251abfce7d6

Detections:

win_emotet_a2

win_emotet_auto

Link:

https://www.unpac.me/results/b9508aae-8054-41db-9a6c-f8b7a5944b06/

Parent samples :

74991102f58f5aa114cb11fe6e624c263a10129c77e917f185e9f19c73a0dad0
835f972d1ccdadbf15d58fce6ae7d471841b1a816efc498c8d60c714e4f45d54
f61f213b63ca8c02400d9436de006c5b33392f1ea9ab07c0c73c2e1b4b9c0c79
e49bdc779eeaa52e085b217a5efe13fbdccce4d33c6b640ddfde03d607a30bde
6542b6beb912d7a9a6320804cd6d74625afb7e1ea077b61c52c9a412ffd306f3
94009ad58c4034013608dd6e571e28d9a9a83d08792cd05b8aec1ac440648175
d8340f134a4cdc701e06213c96db29e52a279a7be2fd3f6fc10ef29680423971
7ea934ecc247a346def2191b21abd7ff8cf1119bd9dfe8317ed05fc42d2d4b5d
4e8b04939e75d5fb64bd4652e319193a180f3fca01df379892f8de31c8f0b0f9
3d176ae8032697d6449f16caf255dc3c3bf0b96d4546d1af8f9420446566b164
eb4e806ee658b7222aefd64ccadb743fd9dc82865b8cb78c6ed874003b6aeacf
05792796bfb71d01b10ee8041e0758437315551dc3159a4a6a2b4e1cda557d38
ed235c8cf8895b7104f70ad7fb3d6c8dfddaa152edb4c69f7e1ca9d77e26d127
642e374a327b3fb444f13e54572a43376e7323edd70c7775ba9d1e2e4d29ad9b
c2f7114f72203d60f4e148408ce3ef51df299ef99635644993ebc5a45603c76a
618e0e8da4700e6ed2f806e34be5c8464d3cb50045b5beda514a176547edaa02
96d428799f1616d6c13c1b1a4db5ce44e3fff8bbe4e335506567da911621ed15
8692486be894d9d3fb357de86c88fd65fe727b7ca479ca2e29b7d04b47a1cecd
99b11e57cdbb1f15c08016e00cb9865a0a023cefa69818e763b4ff4a75fec00d

SH256 hash:

642e374a327b3fb444f13e54572a43376e7323edd70c7775ba9d1e2e4d29ad9b

MD5 hash:

bbb6aec1c34d4960386f5ec8c83b10ce

SHA1 hash:

4464ca53e8681a902877977572b1bb58436356fe

Link:

https://www.unpac.me/results/b9508aae-8054-41db-9a6c-f8b7a5944b06/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Win32_Trojan_Emotet Create hunting rule
Author:	ReversingLabs
Description:	Yara rule that detects Emotet trojan.

Rule name:	win_emotet_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator