MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ef4dd4d32516b7b0e05f85c3ad277ec1d3a5baae421f33f013b615192216302. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet (aka Heodo)

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments 1

SHA256 hash:	6ef4dd4d32516b7b0e05f85c3ad277ec1d3a5baae421f33f013b615192216302
SHA3-384 hash:	699126fa64c5b988480e481e3831f75601ee9ada10acb0926f315ed0edd45d740ea5c92cf6404865c5b3e583dceba208
SHA1 hash:	e47ea2bb88e3209e7b5207863db7990fc37559e4
MD5 hash:	350294d5edd13547214b9cae60969490
humanhash:	lima-tennis-three-table
File name:	350294d5edd13547214b9cae60969490
Download:	download sample
Signature	Heodo Create hunting rule
File size:	1'019'904 bytes
First seen:	2022-03-15 16:55:16 UTC
Last seen:	2022-04-20 10:23:41 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	9cf6025d2631a46e01cb03996065b088 (86 x Heodo)
ssdeep	12288:tORt+oQnWSdv9mjbaNNlo8XKl0OlbT5ebFj90OW0GB8F+YL:tC+oQnWAebaC8Ul65Whg
Threatray	2'015 similar samples on MalwareBazaar
TLSH	T127257D51B942803EE8BF013E443B6379166A2908567ACFD71AD51FEC8F34996C937BC2
File icon (PE):
dhash icon	5c34d6cea4e0f1f0 (84 x Heodo)
Reporter	zbetcheckin
Tags:	32 dll Emotet exe Heodo

Intelligence

File Origin

# of uploads :

# of downloads :

191

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Emotet

Link:

https://www.capesandbox.com/analysis/250988/

Detection(s):

SecuriteInfo.com.Artemis94C2A7E395CF.30505.17722.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

control.exe greyware keylogger shell32.dll

Link:

https://www.filescan.io/uploads/6230c535b94fb38cb4866e6c/reports/d57e6438-1405-4010-b786-dcacccb61071/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Emotet

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a37542b0-f580-415e-b90d-e275592c2cd4

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6ef4dd4d32516b7b0e05f85c3ad277ec1d3a5baae421f33f013b615192216302/

Threat name:

Win32.Trojan.Emotet

Status:

Malicious

First seen:

2022-03-15 17:14:54 UTC

AV detection:

22 of 27 (81.48%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=n32n2tjskfvxwdqf7bodvutx5qotuw5k4qq7gpybhnqvderbmmba._file

Verdict:

malicious

Label(s):

emotet

Heodo

40b5b3818636809145e6b6d9d157ba3cf50df3e32f665c16d3553c7b2c8b4e57

Heodo

4547ff21c5b35e53fa3ef4eaf73b97ad90cc66f838c730173d94676c66ce85ed

Heodo

5df60f2fde243f2e884089c5c19335a22e25d56ec03dd1b3b2f3be0160201467

Heodo

8fbc12816beeabc547e49abc668d772f1771498ad6a3739f4cd417c2aa55ebfe

Heodo

a90e348f636488c29756e8631b55414da1042a4a13a92c75eac80a7a7ef6ab4c

Heodo

ad9f5e3ac5323892bb626eed057e2d41b652be8a1c89bea111e64aff8dae5040

Heodo

e428eaf62376cfe30fc20e25c62cd38fd3bdb86072a50c165725337425fb1615

Heodo

ea34ea6ffe63ca9266cc6f39141b8d443c6b145a973a26ac50f78c5ac562b94a

Heodo

+ 2'005 additional samples on MalwareBazaar

Result

Malware family:

emotet

Score:

10/10

Tags:

family:emotet botnet:epoch5 banker trojan

Link:

https://tria.ge/reports/220315-vfn1vadfe8/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of WriteProcessMemory

Drops file in System32 directory

Emotet

Malware Config

C2 Extraction:

51.75.33.122:443
186.250.48.5:80
168.119.39.118:443
207.148.81.119:8080
194.9.172.107:8080
139.196.72.155:8080
78.47.204.80:443
159.69.237.188:443
45.71.195.104:8080
54.37.106.167:8080
185.168.130.138:443
37.44.244.177:8080
185.184.25.78:8080
185.148.168.15:8080
128.199.192.135:8080
37.59.209.141:8080
103.41.204.169:8080
185.148.168.220:8080
103.42.58.120:7080
78.46.73.125:443
68.183.93.250:443
190.90.233.66:443
5.56.132.177:8080
62.171.178.147:8080
196.44.98.190:8080
168.197.250.14:80
66.42.57.149:443
59.148.253.194:443
104.131.62.48:8080
191.252.103.16:80
54.37.228.122:443
88.217.172.165:8080
195.77.239.39:8080
116.124.128.206:8080
93.104.209.107:8080
118.98.72.86:443
217.182.143.207:443
87.106.97.83:7080
210.57.209.142:8080
54.38.242.185:443
195.154.146.35:443
203.153.216.46:443
198.199.98.78:8080
85.214.67.203:8080

Unpacked files

SH256 hash:

6ef4dd4d32516b7b0e05f85c3ad277ec1d3a5baae421f33f013b615192216302

MD5 hash:

350294d5edd13547214b9cae60969490

SHA1 hash:

e47ea2bb88e3209e7b5207863db7990fc37559e4

Link:

https://www.unpac.me/results/2039f455-0c8f-42ab-a647-5a37569f240c/

Malware family:

Emotet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/6ef4dd4d3251/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6ef4dd4d32516b7b0e05f85c3ad277ec1d3a5baae421f33f013b615192216302

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.