MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 685ca45b9a2d9acd96e32ba3055b4a9e7e57964e644f403ac62ada0a45685eeb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 685ca45b9a2d9acd96e32ba3055b4a9e7e57964e644f403ac62ada0a45685eeb
SHA3-384 hash: 1c0a53903e5659224a4a193891f4810a455e0cc6421baa3deb2af77f2d39a931fade55878f593ecbc6e6551e4f42ab2a
SHA1 hash: 6ee3018eff52dfdbddd20b3c5300acee9d9d9842
MD5 hash: 64f67a94fa3648839edc2b714d86dd7b
humanhash: comet-lemon-nuts-one
File name:emotet_exe_e4_685ca45b9a2d9acd96e32ba3055b4a9e7e57964e644f403ac62ada0a45685eeb_2021-11-26__081209.exe
Download: download sample
Signature Heodo
Create hunting rule
File size:485'888 bytes
First seen:2021-11-26 08:12:14 UTC
Last seen:2021-11-26 09:48:32 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash a67ad3f2c7f4c937ce61f03a8b5a902f (18 x Heodo)
ssdeep 12288:o4xZ0/tI1BD2LETv0FhjO9U6W8XUDaBN7a1vt:oED2LETvMBb6WWUDcxwv
Threatray 403 similar samples on MalwareBazaar
TLSH T17FA4BF11F982D072D1BD15303D35DB968A6DBC604FE4C9EB67E42B2D8E352C14B36E2A
Reporter Cryptolaemus1
Tags:dll Emotet epoch4 exe Heodo


Avatar
Cryptolaemus1
Emotet epoch4 exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
115
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.Variant.Fragtor.44700.16389.8015.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
DNS request
Launching a process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/61a0971002c80febc2a9fd62/reports/c6fba4b0-3c9b-4fb5-9645-72f7b6a8bba7/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/dc7b9c8c-9c1d-4b13-a633-48d4bc7eb88c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/685ca45b9a2d9acd96e32ba3055b4a9e7e57964e644f403ac62ada0a45685eeb/
Threat name:
Win32.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2021-11-26 08:13:12 UTC
File Type:
PE (Dll)
Extracted files:
4
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
emotet
Create hunting rule
Similar samples:
0a45cd8651ac5ef2f5aa75e8113ece6dbe93d40b1eda0578a099c582e42b79d6
Heodo
164539774c24d8d5451e9dc16d27932a59afb57dee1403bf11856e63e7b46d94
Heodo
2d93bb25758b6274fea3744434a4553727f88a0d6479133ac7e7115e403fa54c
Heodo
5c07f9b3153c78dc817bd30176bde3940fa584506f1c08675434f110f175a209
Heodo
8f46d8798130dab09b94788806602476ff62fa1164d62d95ccde9319616c631d
Heodo
91019710541b9089dd5decbb2713ab7d489cb9962e6fefd1900ea729820217db
Heodo
d1eb2c3fcaa5925cde21ca218566fd6c75f2370605303dcf584c2918e2c7b978
Heodo
e9b3fe6b797a79043b0b9e346f1681c7298051e5442db4bede31dcaae7754952
Heodo
f2243fbb56a5ceafdbac83568f997149541d5f5f483d7484f9d5cbdb2f2c8c40
Heodo
fe062027b6cb1a6f767e84984195066e4b86ce524b418382150a35a58cf852d6
Heodo
+ 393 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/211126-j4eljabcdl/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
71bca636bf32b259ec871e0c7db1d144ddd4de477d40c98de173f2ad537d048b
MD5 hash:
c339b940c5c70a8c4bb28ddb5dfa0a9c
SHA1 hash:
324e330b8a93fa40bcccaface39169c0b576248c
Detections:
win_emotet_a2
Create hunting rule
win_emotet_auto
Create hunting rule
Link:
https://www.unpac.me/results/547fda17-b156-4a92-bcb6-e8ec4f529696/
SH256 hash:
685ca45b9a2d9acd96e32ba3055b4a9e7e57964e644f403ac62ada0a45685eeb
MD5 hash:
64f67a94fa3648839edc2b714d86dd7b
SHA1 hash:
6ee3018eff52dfdbddd20b3c5300acee9d9d9842
Link:
https://www.unpac.me/results/547fda17-b156-4a92-bcb6-e8ec4f529696/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/685ca45b9a2d9acd96e32ba3055b4a9e7e57964e644f403ac62ada0a45685eeb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/209607/

Comments