MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6bc898debe1750db44882456c3ed9ed5f17574d9a3c9079b5ac6a5f00ce1462f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6bc898debe1750db44882456c3ed9ed5f17574d9a3c9079b5ac6a5f00ce1462f
SHA3-384 hash: 711c517b030e2f194ad1a72ba8939600ddd57b10f3ef41c167e118f28ba9b82f5626d52640e065a3ae71cf7bd061e4dc
SHA1 hash: b401cdacfeab967748cdb42747b8736aaa3744ed
MD5 hash: f0a6cc589a6ab3791921f134d8b800b4
humanhash: sink-tennessee-three-fourteen
File name:pNpjpneXfJb.dll
Download: download sample
Signature Heodo
Create hunting rule
File size:644'608 bytes
First seen:2022-11-02 23:24:49 UTC
Last seen:2022-11-02 23:26:03 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 600977113aed842192f68fb1457a6d66 (66 x Heodo)
ssdeep 12288:6tGis7p49VmD3OjG7QbBtLZ5WhNye5JHKVu6cig1Doa:6tGis1T3OjueLehd5NKAD3
Threatray 5'243 similar samples on MalwareBazaar
TLSH T1F3D49D0BFB6CC0A6D067D139C5639B86EB71BC5D8B30974B1394975A2F337A0993A312
TrID 37.7% (.SCR) Windows screen saver (13101/52/3)
30.3% (.EXE) Win64 Executable (generic) (10523/12/4)
14.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.8% (.EXE) OS/2 Executable (generic) (2029/13)
5.7% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon 71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT)
Reporter Anonymous
Tags:Emotet exe Heodo

Intelligence

File Origin
# of uploads :
2
# of downloads :
213
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
pNpjpneXfJb.dll
Verdict:
No threats detected
Analysis date:
2022-11-02 23:27:17 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/57664d60-0c70-43df-bb46-56c51c418834

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/327422/
Detection(s):
SecuriteInfo.com.Win64.BotX-gen.15363.31491.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching a process
DNS request
Sending a custom TCP request
Forced system process termination
Moving of the original file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware keylogger packed shell32.dll
Link:
https://www.filescan.io/uploads/6362fc5058409ff7bc0c9405/reports/4e408c38-af8e-46b4-b62e-8f052a071f84/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2e0f38f1-b397-46f5-a9c0-069c861d71d2
Result
Threat name:
Emotet
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1103841
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Creates an autostart registry key pointing to binary in C:\Windows
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected Emotet
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 736503 Sample: pNpjpneXfJb.dll.exe Startdate: 03/11/2022 Architecture: WINDOWS Score: 96 35 129.232.188.93 xneeloZA South Africa 2->35 37 45.235.8.30 WIKINETTELECOMUNICACOESBR Brazil 2->37 39 51 other IPs or domains 2->39 45 Antivirus detection for URL or domain 2->45 47 Multi AV Scanner detection for submitted file 2->47 49 2->49 51 3 other signatures 2->51 9 loaddll64.exe 1 2->9         started        11 regsvr32.exe 2 2->11         started        signatures3 process4 signatures5 14 regsvr32.exe 1 9->14         started        17 cmd.exe 1 9->17         started        19 rundll32.exe 2 9->19         started        21 conhost.exe 9->21         started        59 Hides that the sample has been downloaded from the Internet (zone.identifier) 11->59 23 regsvr32.exe 11->23         started        process6 signatures7 61 Hides that the sample has been downloaded from the Internet (zone.identifier) 14->61 25 regsvr32.exe 1 14->25         started        29 rundll32.exe 2 17->29         started        31 regsvr32.exe 19->31         started        process8 dnsIp9 41 182.162.143.56, 443, 49704 LGDACOMLGDACOMCorporationKR Korea Republic of 25->41 53 System process connects to network (likely due to code injection or exploit) 25->53 55 Creates an autostart registry key pointing to binary in C:\Windows 25->55 43 192.168.2.1 unknown unknown 29->43 57 Hides that the sample has been downloaded from the Internet (zone.identifier) 29->57 33 regsvr32.exe 29->33         started        signatures10 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6bc898debe1750db44882456c3ed9ed5f17574d9a3c9079b5ac6a5f00ce1462f/
Threat name:
Win64.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2022-11-02 23:25:10 UTC
File Type:
PE+ (Dll)
Extracted files:
53
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=npejrxv6c5inwreierlmh3m62xyxk5gzupeqpg22y2s7adhbiyxq._file
Verdict:
malicious
Label(s):
emotet
Create hunting rule
Similar samples:
06db159e2893a3cf22bfc13418a147b21f0701ac468f9338470859d4c68e9597
Heodo
0d8a7eafc8229dc1d210982a5b7d3cae15883d06f22d80d8e869fc7239b5ca2f
Heodo
0eb250078b63e19890162a3ed2599f1991336f4c97451e285490f364db387a81
Heodo
482806bd1cd06f1199163a0520ac7726cae04077bd9ec0046a7bce071d4d5acc
Heodo
62606e178c6c4c2b7174a7aa6e21459e3730bd7a4f9f7b006f5bd2167001c822
Heodo
92359c6aab915f3a21587006c1c874e177c89619d76bbfcaa0c717ff1376ab16
Heodo
a5ddc889d640cc8048e3be8f6b176a97a5aa807337f7274195d0299260c1449c
Heodo
c677b9da47d33e76495bce33e9b167a3ded9ec3f0defefc552720277a53a1850
Heodo
e58d398212732650090b1de0cb02cc8a813a1a61ccc2cb0501b0347157fcc31c
Heodo
+ 5'233 additional samples on MalwareBazaar
Result
Malware family:
emotet
Create hunting rule
Score:
  10/10
Tags:
family:emotet banker persistence trojan
Link:
https://tria.ge/reports/221102-3d95asfcfn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of WriteProcessMemory
Adds Run key to start application
Emotet
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/3bc985b3-bf4e-4250-85f9-3da3f7d91469
Unpacked files
SH256 hash:
7bcbe6cc79b0b4bf68e1b15dd114ffce2bc473ffc45eb009a2d973e0e525a754
MD5 hash:
0aeca1898254fa032861de100dd9cb81
SHA1 hash:
00f5b6443ac23660b17cbd9527d66a7adc5163a9
Detections:
win_emotet_auto
Create hunting rule
win_emotet_a3
Create hunting rule
Link:
https://www.unpac.me/results/3aa5ae9b-9d17-4442-9176-6020fa8dfd5f/
Parent samples :
62606e178c6c4c2b7174a7aa6e21459e3730bd7a4f9f7b006f5bd2167001c822
ff05bd33ae054a570918fbcc448410bf0ed646f34cb378c7f7eec6ec797ae304
5dfa582f296ac270eb81e1839fa5bfcf55a0bd02bf98a772218c0c01320e661d
4820a132ff73343160b6bb2f309ac35728d37bfe43cc5a5673f6ffbfcf485001
3b10027e5be023ee8f6341bfff1fbe2e4c812f855ad345b8ea15e34751af4ea7
61b512ebc8c1097ee06214fe359be65d49f042be64fe1053b7a9932ec73657d5
13e6a930d9b653d014966dff27b6ba80f5a305a33a9f8da4966e7aae7e453f51
293b312991df031417e3205b1b23b94c4741534fb1d56823b12f1126a306f0f6
923766753f81a955d64d6f2f95929410bd16fd0d9006c5054b965a7c1bcfd8cd
0fca9efd589764c60aafe87b9f6926a8404b111f46f38b4f1f0706a86878763f
baaa91c7fc64799e0d0962abfed2a7f0dba827f9c938650b7c40b9bb016ab63c
7ae7ba89883df0a1d932f56599e33c0fc9286cf9dfb66438231d68328d2b2e38
0f78c69f71b46e715404cef58e67a36abc5ad1ad090fd32b452da2c80b02b09f
ceedcc490c7451a2499c4267ebe0e527dc1eff17e6ad609cf76695cb019e1d97
79fec3b7429c04011deac54a293d72034bd9b413b6cca95aeeb0318c3b247c1a
cf937c5cd4d204bbf4a01e490e79c37ebf2dd8d4e06948a1b447d8e888f046a6
54ea5edf347518f63c7638af0c6b593be975162d0fe0924504ae895b4e27d88c
46fcf3750bb2a1459bacd286d6749b35c1d2e64fdb7479b2ead96e3525baf3ec
7c53c1b5a9ca13dde2897dda8db1e9eeabeb980f5a655f5cddfb48a143dd84c1
379852f82ae6b569c501fb845b1c3fb272c2fa965def9fc39460f251fdc33d0e
c044fe7f543d60cc4e02b0ca436a89e0a95bdbdfc3a68df1abf67e06f732ae9a
16444b205c7605eea59960583788f95dce5a2238fee59f492a8512feb4349db5
6bc898debe1750db44882456c3ed9ed5f17574d9a3c9079b5ac6a5f00ce1462f
b5b306b6576a7c53f51bf47d43b8ea2f095a321a43867cd233aa66d23b4ca0f8
5d79578b2c459cb03595f834c6d95b4ad79c614faf3e8e85df0d04a2e2c99930
9f59add71104aa4020aa31813c4249b3c7a39ce8c280ecb69f6c6d2b1f81f43b
384dd5293338e8b76d8702f7f7d7ffaff71e978c35a9827aa320819f5742e11d
7ef401dbf6a1669596fe5f4bef6ec56c7cdeda6b3a745a7bac14103a85cd7ac3
2fd8df51e7d8afe06473c6570232ec20cc3d3999e5b959def84b027f83a77f28
ba42b3aee2e94d845666cf1f1ee462c51941041f72fc268943eef4909bc1999f
3b11613857aa31b30755f1a0efbc275e293ac22c7e630cf7f9d398939562281c
6b842c2c86e743028ab9823cbdfe0cabdaf045bc96d1adc457cbdc210175cc03
9a275d62d6d6c0b820dd58b6705c9c2cfc13b618ea344a346d8042a5b8d643d4
89fd11efa769f4b8fc9c1bcecd6be19cee1b16de95ca6253496771327eebc5de
d30d60fb74266669e90a17494177e72a0cc6e4940419f8d1dc547d2e2189d652
3e066effdf652204823426b10b7723935fb8f290f85a894e2992362a5be291d0
cc419bbca8d88681720e3ed9ac589afe639c6e5b7521ef039f1250335f7e9d97
816720a67eccfdba29cdf52573f8a3787f3888f039820519a1eb24c1b2bce743
0c88808f9c232da17b3f2eb53015799f572874f6e53145bebee6f53eeeb53a08
11c20af05ce2ad1f2912d0545dc294198bf2e51c5316b504be6b2dc0566af115
50b91f28faf8fd6f30fc594678f1f2b73db5a438ba4a7283ebebfb2f111a2565
dab47fad5feefd8263d21c563c2a43df2d38a3446597af99afd090e2ac404b55
a7c002838c946c6a1fc648df2a7f332716eac810d368fa0dd39f738f938643cc
33b56c4a5c96f2bd15cbc72a07a5cc8030d450b57c3de45a3aebe3f529db7736
b8e551c4e5be8f502f6cf710b91b621252049c5ded95a5f3bbbae2419180c832
d575dafe95a55d552d577614d5d041dd1fd8a0a5ea94e13d4e24be929d751a9f
c8fced166c22208fa25720a98d2a47f5d372c05a04119f6589804f9b64b1c7fc
5b624a9f5bfe4e943d06f6795e47056665f4923500d4bf86f48b4b7d43354416
b3c81640df3e8620328caf7c676100b02450e6d492fb482daaf5238d30745f96
a85eb01c802eaa1c6c6bcea8e1de3e8f3a7e8ec80cd6e6e1e2142104a44dcf25
ad91d025d421690cd712b97c852645b6b6536ecac71cf6827d5f3eadbb3c1c85
adbe02d575c379ed25eb086bbc5756612e628ddf2a927ded44f433247f24a947
5ef55c5c2b2be6d2486cad5ae6eda61535393c2aa180a701f556b64f9abeeb2e
42c5340214ab0b56f74a95067e546f27c63855b957cd60e8523ad70ac64c64ea
e4548d204cde95f32f43d6834145cfc48bd6ebc6ae3cb2cf2fcae9b7c4ca56b6
f79d93cd54bb3a54b47e01eb21ce66995bf38c23490a7e380f5c43b319315579
e4dac385eec7c6f79a2269ab644b536a5ad710e5115678203818484551f9fe6a
c721b8e3212096dfb89f63b8c6e65829bfa80d1fffef39f995a7b5c8270dde1c
4000772a9f50e0ea5b033e2a35247a82a9eb989c29e1cf48bcf127f3508d5889
e59a6e7999ad03f15c3c67b6c068edf53be3d8153ee10e9f6794bd2914c14378
55ea014fcc0e99224bb83ec4e6faefdf1f7275f51f70db755babe3d49d9bf871
d782617037404b290565214464f9bb696021c8417330b603d777dd78d4d69caf
9552854e3bd6e3564eb8721075c7c4f173cb8aac03f81ca00bda024792df7456
4881e5e0e6528bdcc50fd3f1f106d6877f5b5e5bbde58e347a036d7bb37c8bb1
SH256 hash:
6bc898debe1750db44882456c3ed9ed5f17574d9a3c9079b5ac6a5f00ce1462f
MD5 hash:
f0a6cc589a6ab3791921f134d8b800b4
SHA1 hash:
b401cdacfeab967748cdb42747b8736aaa3744ed
Link:
https://www.unpac.me/results/3aa5ae9b-9d17-4442-9176-6020fa8dfd5f/
Malware family:
Emotet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6bc898debe17/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6bc898debe1750db44882456c3ed9ed5f17574d9a3c9079b5ac6a5f00ce1462f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/327422/

Comments