MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6cccbede4a804b8746c63fd1940c5ac77893053ad4cc618e99966e8f5579f157. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6cccbede4a804b8746c63fd1940c5ac77893053ad4cc618e99966e8f5579f157
SHA3-384 hash: db0fc329a84999b67089909f26c1f6987ed20a299612eed4da354a354d897b9316b13c5b8285019017c5fe49bfee82a5
SHA1 hash: 2e8ee5ffa5b2dfb4f610621b63140a893c8891ab
MD5 hash: 8995dd11073738a1fe58c89a5e216ec5
humanhash: single-johnny-cat-indigo
File name:8995dd11073738a1fe58c89a5e216ec5
Download: download sample
Signature Heodo
Create hunting rule
File size:591'360 bytes
First seen:2022-07-14 06:47:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1c5c45f819ffed1f8a226b23fc12dfaa (69 x Heodo)
ssdeep 12288:yocc2tri1Ut9aa2lI1ZrmNQo3A17bDRRySLhqcsI9HdFFlsQzTM5i:yocc21t9aaLowpDDySL8c39bui
TLSH T148C48E0772F1B5B8D205C0344A4EE532A736B9CD1422EE5F26E1D6302FEA9A21F7E55C
TrID 33.1% (.MZP) WinArchiver Mountable compressed Archive (3000/1)
22.3% (.EXE) OS/2 Executable (generic) (2029/13)
22.0% (.EXE) Generic Win/DOS Executable (2002/3)
22.0% (.EXE) DOS Executable Generic (2000/1)
0.3% (.VXD) VXD Driver (29/21)
Reporter openctibr
Tags:Emotet exe Heodo OpenCTI.BR Sandboxed

Intelligence

File Origin
# of uploads :
1
# of downloads :
137
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/288617/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.50380837.8330.2147.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/62cfbc6b8dab2096b997e97f/reports/8fbefaee-6a26-4604-8013-9caa653eb18b/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6cccbede4a804b8746c63fd1940c5ac77893053ad4cc618e99966e8f5579f157/
Threat name:
Win64.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2022-06-04 13:50:41 UTC
File Type:
PE+ (Dll)
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ntgl5xskqbfyorwgh7izidc2y54jgbj22tggdduzszxi6vlz6flq._file
Verdict:
malicious
Result
Malware family:
emotet
Create hunting rule
Score:
  10/10
Tags:
family:emotet botnet:epoch5 banker trojan
Link:
https://tria.ge/reports/220714-hkx34aahcn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of WriteProcessMemory
Emotet
Malware Config
C2 Extraction:
78.47.204.80:443
62.171.178.147:8080
165.232.185.110:8080
103.41.204.169:8080
54.37.228.122:443
202.29.239.162:443
103.71.99.57:8080
64.227.55.231:8080
85.214.67.203:8080
139.196.72.155:8080
195.77.239.39:8080
202.28.34.99:8080
54.37.106.167:8080
103.126.216.86:443
68.183.91.111:8080
104.244.79.94:443
85.25.120.45:8080
116.124.128.206:8080
210.57.209.142:8080
103.85.95.4:8080
188.225.32.231:4143
118.98.72.86:443
37.44.244.177:8080
87.106.97.83:7080
103.56.149.105:8080
128.199.217.206:443
103.254.12.236:7080
59.148.253.194:443
36.67.23.59:443
202.134.4.210:7080
196.44.98.190:8080
178.62.112.199:8080
103.224.241.74:8080
157.245.111.0:8080
104.248.225.227:8080
93.104.209.107:8080
88.217.172.165:8080
175.126.176.79:8080
157.230.99.206:8080
Unpacked files
SH256 hash:
b62c1c1955bd49ad67e54ddbfe6eda415e4ce60429bb10826701730705a1df88
MD5 hash:
898d44479ab9a5533e871485a0d0bf30
SHA1 hash:
e459befc63f1cf11ffa1de55cb0a5a72b2155374
Detections:
win_emotet_a3
Create hunting rule
Link:
https://www.unpac.me/results/f4be436c-d873-4278-b15d-e79b1164ef45/
Parent samples :
ca586ef748e4bde04d92056f28bd5545af3648c107930f789c3c8b218b169691
b1ea6dfcf37b87ec63ae245b21d9ba63c1dd716b8e58bcd32e5617a02f9c205c
6cccbede4a804b8746c63fd1940c5ac77893053ad4cc618e99966e8f5579f157
5575340761c2fe30cf62505f7814c3d664fffa5a1e8ccdcdf724f98ea101cc16
ba58341a0e918325b0119ca115b0ea23b3403e5488bb9f7a6693ddcfd17dec66
ff0f629bd9fbd111436721642d914c454ae644582ea05ff52c3100c06b540a47
SH256 hash:
6cccbede4a804b8746c63fd1940c5ac77893053ad4cc618e99966e8f5579f157
MD5 hash:
8995dd11073738a1fe58c89a5e216ec5
SHA1 hash:
2e8ee5ffa5b2dfb4f610621b63140a893c8891ab
Link:
https://www.unpac.me/results/f4be436c-d873-4278-b15d-e79b1164ef45/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.96
Link:
https://yomi.yoroi.company/submissions/6cccbede4a804b8746c63fd1940c5ac77893053ad4cc618e99966e8f5579f157

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Emotet_2022
Create hunting rule
Author:Marcelo Rivero
Description:Emotet EP4 unpacked
Rule name:Emotet_EP4up
Create hunting rule
Author:Marcelo Rivero
Description:Emotet EP4 unpacked

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Heodo

Executable exe 6cccbede4a804b8746c63fd1940c5ac77893053ad4cc618e99966e8f5579f157

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2223663/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/288617/

Comments