MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 663691f9df3d17dde6330cff50e30c63ec795ac0b6969986c6c31414231cadbb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet (aka Heodo)

Vendor detections: 13

Intelligence 13 IOCs YARA 8 File information Comments

SHA256 hash:	663691f9df3d17dde6330cff50e30c63ec795ac0b6969986c6c31414231cadbb
SHA3-384 hash:	550a781183c0009f668a53371be5cb9aab3bce011dd0397daf63ed9dc3a73a4681cd5b6ba1a026e8eb79cdb7c7e3b06b
SHA1 hash:	6caffd90a124d927c11c00b12e64305d23f0d4dc
MD5 hash:	242dbfb71d9542ea21bffe814b8ffffb
humanhash:	bacon-wyoming-december-connecticut
File name:	file
Download:	download sample
Signature	Heodo Create hunting rule
File size:	622'592 bytes
First seen:	2022-10-27 14:48:52 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	7762a5f605650a2600f2aed13f89dc19 (20 x Heodo)
ssdeep	6144:Z25vnlVjWYhbZ0Q23WLqLdiP3VhlR7+5kvHf+rSC/7BIOg2WrFr3Hhjxf:Z25vlVjndj23/LcPnlkmvHf+F4VF
TLSH	T1C6D48D12BBE1C075C9A242314FE6E771A7F6ED6009318B4723D09F1F7E39A425A36B25
TrID	45.4% (.CPL) Windows Control Panel Item (generic) (197083/11/60) 26.8% (.OCX) Windows ActiveX control (116521/4/18) 9.9% (.EXE) InstallShield setup (43053/19/16) 7.1% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 3.0% (.SCR) Windows screen saver (13101/52/3)
dhash icon	0820187960701000 (1 x Heodo)
Reporter	jstrosch
Tags:	Emotet exe Heodo

Intelligence

File Origin

# of uploads :

# of downloads :

255

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

emotet

ID:

File name:

file

Verdict:

Malicious activity

Analysis date:

2022-10-27 14:50:39 UTC

Tags:

installer emotet

Link:

https://app.any.run/tasks/cf2efc2e-8048-4a25-9f48-41840ae7cf6c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Emotet

Link:

https://www.capesandbox.com/analysis/324929/

Detection(s):

Win.Dropper.Emotet-9871373-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the system32 subdirectories

Creating a file

Sending a custom TCP request

Creating a file in the %AppData% subdirectories

Moving a file to the %AppData% subdirectory

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/45997/overview

Behaviour

MalwareBazaar

CheckScreenResolution

CursorPosition

CheckCmdLine

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Emotet

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9e5e58d6-2965-45c3-90eb-432394616032

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/663691f9df3d17dde6330cff50e30c63ec795ac0b6969986c6c31414231cadbb/

Threat name:

Win32.Trojan.Emotet

Status:

Malicious

First seen:

2020-09-24 07:13:00 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

33 of 41 (80.49%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=my3jd6o7hul53zrtbt7vbyymmpwhswwaw2ljtbwgymkbiiy4vw5q._file

Verdict:

malicious

Label(s):

emotet

Result

Malware family:

emotet

Score:

10/10

Tags:

family:emotet botnet:epoch1 banker dave trojan

Link:

https://tria.ge/reports/221027-r6z91scdg6/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Dave packer

Emotet payload

Emotet

Malware Config

C2 Extraction:

74.136.144.133:80
51.38.124.206:80
178.79.163.131:8080
82.196.15.205:8080
212.71.237.140:8080
67.247.242.247:80
87.106.46.107:8080
104.131.103.37:8080
83.169.21.32:7080
45.161.242.102:80
110.142.219.51:80
45.173.88.33:80
187.162.248.237:80
5.196.35.138:7080
72.47.248.48:7080
186.103.141.250:443
98.13.75.196:80
77.90.136.129:8080
186.70.127.199:8090
152.169.22.67:80
72.167.223.217:8080
45.33.77.42:8080
64.201.88.132:80
184.66.18.83:80
177.73.0.98:443
70.32.115.157:8080
137.74.106.111:7080
188.2.217.94:80
77.238.212.227:80
111.67.12.221:8080
50.121.220.50:80
153.162.105.97:80
38.88.126.202:8080
50.28.51.143:8080
51.255.165.160:8080
190.115.18.139:8080
172.104.169.32:8080
206.15.68.237:443
199.203.62.165:80
104.131.41.185:8080
217.13.106.14:8080
73.213.208.163:80
68.183.170.114:8080
170.81.48.2:80
111.67.77.202:8080
190.6.193.152:8080
74.58.215.226:80
95.9.180.128:80
51.159.23.217:443
71.197.211.156:80
68.183.190.199:8080
138.97.60.141:7080
185.94.252.27:443
94.176.234.118:443
12.162.84.2:8080
209.236.123.42:8080
45.16.226.117:443
190.190.148.27:8080
181.30.61.163:443
190.147.137.153:443
190.195.129.227:8090
189.2.177.210:443
5.189.178.202:8080
192.241.143.52:8080
181.129.96.162:8080
216.47.196.104:80
192.241.146.84:8080
70.32.84.74:8080
103.106.236.83:8080
190.2.31.172:80
219.92.13.25:80
2.47.112.152:80
190.24.243.186:80
190.163.31.26:80
213.197.182.158:8080
185.215.227.107:443
217.199.160.224:7080
191.182.6.118:80
61.92.159.208:8080
188.135.15.49:80
72.135.200.124:80
178.250.54.208:8080
54.37.42.48:8080
204.225.249.100:7080
82.76.111.249:443
177.74.228.34:80
65.36.62.20:80
185.94.252.12:80
185.178.10.77:80
68.69.155.181:80

Unpacked files

SH256 hash:

e02817c8888369bfa05937dd8fbcaf367f95afc93a7cffc9650f0d324e8f10a8

MD5 hash:

510f3d0ea06e6026f959b60f6f6320fe

SHA1 hash:

928bdd0a76ad7b5131ac83aa8a92fcd352431800

Detections:

win_emotet_auto

win_emotet_a2

Link:

https://www.unpac.me/results/0101191d-a272-4578-827b-22e4f6e8a730/

SH256 hash:

893b272a1721c887c47365204b8266d1a9c20cd6027fc5468f84576f893ce8b8

MD5 hash:

af902920d610b37a5eeb255066cb48bb

SHA1 hash:

10ff66de10ecf157c065959f7e3c297e14cf3002

Detections:

win_grimagent_auto

win_emotet_auto

win_emotet_a2

Link:

https://www.unpac.me/results/0101191d-a272-4578-827b-22e4f6e8a730/

SH256 hash:

663691f9df3d17dde6330cff50e30c63ec795ac0b6969986c6c31414231cadbb

MD5 hash:

242dbfb71d9542ea21bffe814b8ffffb

SHA1 hash:

6caffd90a124d927c11c00b12e64305d23f0d4dc

Link:

https://www.unpac.me/results/0101191d-a272-4578-827b-22e4f6e8a730/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/663691f9df3d/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.10

Link:

https://yomi.yoroi.company/submissions/663691f9df3d17dde6330cff50e30c63ec795ac0b6969986c6c31414231cadbb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Cobalt_functions Create hunting rule
Author:	@j0sm1
Description:	Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

Rule name:	Emotet Create hunting rule
Author:	kevoreilly
Description:	Emotet Payload

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

Rule name:	meth_peb_parsing Create hunting rule
Author:	Willi Ballenthin

Rule name:	win_emotet_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.emotet.

Rule name:	win_grimagent_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.grimagent.

Rule name:	win_icondown_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

Rule name:	win_sisfader_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator