MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 70a28cc1015d8cce0b7cb698980ed5ba8e13af119e83d69d7a81414144575a81. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 70a28cc1015d8cce0b7cb698980ed5ba8e13af119e83d69d7a81414144575a81
SHA3-384 hash: bf6750c97a292729ddee5ea9971ee154c0f50ae9750c1969ab6002b7fcfe738f3af4c617aa9406e4727eb893fe0eb345
SHA1 hash: 9d6f03acdfb572258e889e6a7eea9a7fd68ffcc5
MD5 hash: 343661b61b464f2ac4bce4d207257241
humanhash: maine-nuts-lake-diet
File name:343661b61b464f2ac4bce4d207257241
Download: download sample
Signature Heodo
Create hunting rule
File size:536'576 bytes
First seen:2022-06-01 13:13:06 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash f372ffd215ce36fff280c952ece006b4 (14 x Heodo)
ssdeep 6144:YcVWFmnnkp5k9ukaNhdolbmFwvbRSkBReI8FYmoRw3h6nXK5gkxCrxryinSR+KgD:A1q2h+bb7moa3h6a5Yx+R1gh5/
Threatray 2'573 similar samples on MalwareBazaar
TLSH T18BB4BF11F2D1C07AC1AF1339695AD75867BEFC609E78C647EFE02B8E5E315428E24B12
TrID 75.5% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
11.9% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
4.0% (.EXE) Win64 Executable (generic) (10523/12/4)
2.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.9% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon d9c98696d6c03840 (24 x Heodo, 6 x TrickBot)
Reporter zbetcheckin
Tags:32 dll Emotet exe Heodo

Intelligence

File Origin
# of uploads :
1
# of downloads :
268
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/276078/
Detection(s):
Win.Dropper.Emotet-9950417-0
Create hunting rule

SecuriteInfo.com.Trojan.Emotet.1163.19722.22953.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Emotet
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5b3d1d9a-ed50-45e5-8009-6c4733d51ec2
Result
Threat name:
Emotet
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1005059
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected Emotet
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 637555 Sample: YB4lQsRlDB Startdate: 01/06/2022 Architecture: WINDOWS Score: 100 41 Snort IDS alert for network traffic 2->41 43 Antivirus detection for URL or domain 2->43 45 Antivirus / Scanner detection for submitted sample 2->45 47 3 other signatures 2->47 7 loaddll32.exe 1 2->7         started        9 svchost.exe 9 1 2->9         started        12 svchost.exe 2->12         started        14 5 other processes 2->14 process3 dnsIp4 16 rundll32.exe 2 7->16         started        19 cmd.exe 1 7->19         started        21 regsvr32.exe 2 7->21         started        23 rundll32.exe 7->23         started        31 127.0.0.1 unknown unknown 9->31 33 192.168.2.1 unknown unknown 12->33 process5 signatures6 39 Hides that the sample has been downloaded from the Internet (zone.identifier) 16->39 25 regsvr32.exe 16->25         started        29 rundll32.exe 2 19->29         started        process7 dnsIp8 35 149.56.131.28, 49777, 8080 OVHFR Canada 25->35 37 217.182.78.224, 443, 49774, 49775 OVHFR France 25->37 49 System process connects to network (likely due to code injection or exploit) 25->49 51 Hides that the sample has been downloaded from the Internet (zone.identifier) 29->51 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/70a28cc1015d8cce0b7cb698980ed5ba8e13af119e83d69d7a81414144575a81/
Threat name:
Win32.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2022-06-01 13:14:13 UTC
File Type:
PE (Dll)
Extracted files:
49
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ocrizqiblwgm4c34w2mjqdwvxkhbhlyrt2b5nhl2qfaucrcxlkaq._file
Verdict:
malicious
Label(s):
emotet
Create hunting rule
Similar samples:
0090f9a510086f467c48204fb4c04f7ee0abe7ec6c00537a8682fa95e60e1cd1
Heodo
1765a1fb754041a6cb0e1c2f9842aef7c13bd86f9a881cb4d2dd5ee482337b41
Heodo
70a28cc1015d8cce0b7cb698980ed5ba8e13af119e83d69d7a81414144575a81
Heodo
85368fe792a626f164573322a4cadc65ade009134825baf9edb94d5788e77378
Heodo
9fef7122762e939427e278dc4697550d1631507689e3d020659a8feea0fc8bc7
Heodo
e917c75a1a7195c6b1a08982a311052a0c1450320e8dc7b0db35dabe030306af
Heodo
+ 2'563 additional samples on MalwareBazaar
Result
Malware family:
emotet
Create hunting rule
Score:
  10/10
Tags:
family:emotet botnet:epoch4 banker suricata trojan
Link:
https://tria.ge/reports/220601-qgmryscdel/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
Malware Config
C2 Extraction:
217.182.78.224:443
149.56.131.28:8080
138.197.109.175:8080
187.84.80.182:443
79.143.187.147:443
103.43.46.182:443
51.91.7.5:8080
197.242.150.244:8080
27.54.89.58:8080
50.30.40.196:8080
216.158.226.206:443
151.106.112.196:8080
167.172.253.162:8080
189.126.111.200:7080
101.50.0.91:8080
103.132.242.26:8080
212.24.98.99:8080
185.157.82.211:8080
164.68.99.3:8080
1.234.21.73:7080
45.118.115.99:8080
146.59.226.45:443
91.207.28.33:8080
176.56.128.118:443
79.172.212.216:8080
173.212.193.249:8080
172.104.251.154:8080
167.99.115.35:8080
103.70.28.102:8080
209.126.98.206:8080
160.16.142.56:8080
1.234.2.232:8080
5.9.116.246:8080
58.227.42.236:80
158.69.222.101:443
82.165.152.127:8080
110.232.117.186:8080
176.104.106.96:8080
46.55.222.11:443
103.75.201.2:443
72.15.201.15:8080
107.182.225.142:8080
183.111.227.137:8080
51.91.76.89:8080
209.250.246.206:443
94.23.45.86:4143
129.232.188.93:443
134.122.66.193:8080
206.189.28.199:8080
159.65.88.10:8080
45.176.232.124:443
196.218.30.83:443
185.8.212.130:7080
203.114.109.124:443
188.44.20.25:443
212.237.17.99:8080
185.4.135.165:8080
131.100.24.231:80
51.254.140.238:7080
119.193.124.41:7080
201.94.166.162:443
153.126.146.25:7080
Unpacked files
SH256 hash:
692654c1854975f2db38cf3a077876bd333488b1a6bd299aaa748ba732184699
MD5 hash:
99d13f322aa40ea8428d853f76a58ebc
SHA1 hash:
254c515718ba2977e21bd7c5dab84302841070fc
Detections:
win_emotet_a2
Create hunting rule
Link:
https://www.unpac.me/results/edd14375-c274-4678-90a2-aa7a9d5e0af2/
Parent samples :
6ff55f60e994c6be1c26ec36c467e1abc5301f3ca63e46815c5f0c07d6f7bbaf
1765a1fb754041a6cb0e1c2f9842aef7c13bd86f9a881cb4d2dd5ee482337b41
85368fe792a626f164573322a4cadc65ade009134825baf9edb94d5788e77378
9fef7122762e939427e278dc4697550d1631507689e3d020659a8feea0fc8bc7
e917c75a1a7195c6b1a08982a311052a0c1450320e8dc7b0db35dabe030306af
e612be989abe750b08af25df3796389025e447850f321c66a4b9246259b0a275
0090f9a510086f467c48204fb4c04f7ee0abe7ec6c00537a8682fa95e60e1cd1
70a28cc1015d8cce0b7cb698980ed5ba8e13af119e83d69d7a81414144575a81
SH256 hash:
70a28cc1015d8cce0b7cb698980ed5ba8e13af119e83d69d7a81414144575a81
MD5 hash:
343661b61b464f2ac4bce4d207257241
SHA1 hash:
9d6f03acdfb572258e889e6a7eea9a7fd68ffcc5
Link:
https://www.unpac.me/results/edd14375-c274-4678-90a2-aa7a9d5e0af2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/70a28cc1015d8cce0b7cb698980ed5ba8e13af119e83d69d7a81414144575a81

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALW_emotet
Create hunting rule
Author:Marc Rivero | McAfee ATR Team
Description:Rule to detect unpacked Emotet

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Heodo

DLL dll 70a28cc1015d8cce0b7cb698980ed5ba8e13af119e83d69d7a81414144575a81

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2220430/
Cape
Cape
https://www.capesandbox.com/analysis/276078/

Comments


Avatar
zbet commented on 2022-06-01 13:13:11 UTC

url : hxxp://dmaicinnovations.com/Swift-5.0.2/5Wg/