MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 78a7f0a26d5cb1b13b6dc67fdc247fa0f173564651d434ed4c17cdecb7dff561. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 8


Intelligence 8 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 78a7f0a26d5cb1b13b6dc67fdc247fa0f173564651d434ed4c17cdecb7dff561
SHA3-384 hash: 750e81c3fdbd1c4c9884a3bd04b4e6adf621221e77e7e592d94f8d4ce774a7f5dbe418d5135f6767693f08a52f97da4b
SHA1 hash: 5a22b9c71adebc2f802401ce1ba70c3af54bc13b
MD5 hash: 35b585a5d17d68ce0ec16c59dee32a6d
humanhash: romeo-six-solar-massachusetts
File name:Fattura n. 8139557 del 16.05.2022 lnk
Download: download sample
Signature Heodo
Create hunting rule
File size:2'672 bytes
First seen:2022-05-16 09:56:22 UTC
Last seen:Never
File type:Shortcut (lnk) lnk
MIME type:application/octet-stream
ssdeep 48:8mY6xU8cxm7XLXjYgzUmdNA3O4b2dt6BKRv4eq4ab:8mdOUZ1NoO4b2HyKRgT4
TLSH T120517C382EDE1129F5F3AFB16DD869D5DEAAB6B375018D5E0082034A4952A40ED82D3E
Reporter JAMESWT_WT
Tags:Heodo lnk pw cm2FrCxH

Intelligence

File Origin
# of uploads :
1
# of downloads :
178
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malicious
File Type:
LNK File - Malicious
Link:
https://app.docguard.net/78a7f0a26d5cb1b13b6dc67fdc247fa0f173564651d434ed4c17cdecb7dff561/results/dashboard
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cmd cmd.exe control.exe evasive greyware masquerade packed powershell powershell
Link:
https://www.filescan.io/uploads/62821ff622b733139c202a3b/reports/127a8200-917a-4737-b952-cde15e250058/overview
Result
Verdict:
MALICIOUS
Details
Base64 Encoded Powershell Directives
Detected one or more base64 encoded Powershell directives.
Base64 Encoded URL
Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.
Result
Threat name:
Emotet
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/994779
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Obfuscated command line found
Powershell drops PE file
Suspicious command line found
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Windows shortcut file (LNK) starts blacklisted processes
Yara detected Emotet
Yara detected Obfuscated Powershell
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 627290 Sample: Fattura n. 8139557 del 16.0... Startdate: 16/05/2022 Architecture: WINDOWS Score: 100 47 Multi AV Scanner detection for domain / URL 2->47 49 Malicious sample detected (through community Yara rule) 2->49 51 Antivirus detection for URL or domain 2->51 53 9 other signatures 2->53 8 cmd.exe 1 2->8         started        11 svchost.exe 9 1 2->11         started        14 svchost.exe 1 2->14         started        16 3 other processes 2->16 process3 dnsIp4 57 Windows shortcut file (LNK) starts blacklisted processes 8->57 59 Suspicious powershell command line found 8->59 18 powershell.exe 14 21 8->18         started        23 conhost.exe 1 8->23         started        39 127.0.0.1 unknown unknown 11->39 41 192.168.2.1 unknown unknown 14->41 signatures5 process6 dnsIp7 37 www.dl5.zahra-media.ir 94.182.186.124, 443, 49754 RASANAIR Iran (ISLAMIC Republic Of) 18->37 33 C:\Users\user\AppData\...behaviorgraphkUlGLvEGu.bRO, PE32+ 18->33 dropped 55 Powershell drops PE file 18->55 25 regsvr32.exe 5 18->25         started        file8 signatures9 process10 file11 35 C:\Windows\...\cdVXHIDuBTOOqpZ.dll (copy), PE32+ 25->35 dropped 61 Hides that the sample has been downloaded from the Internet (zone.identifier) 25->61 29 regsvr32.exe 25->29         started        signatures12 process13 dnsIp14 43 23.239.0.12, 443, 49789 LINODE-APLinodeLLCUS United States 29->43 45 150.95.66.124, 49803, 8080 GMO-Z-COM-THGMO-ZcomNetDesignHoldingsCoLtdSG Singapore 29->45 63 System process connects to network (likely due to code injection or exploit) 29->63 signatures15
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/78a7f0a26d5cb1b13b6dc67fdc247fa0f173564651d434ed4c17cdecb7dff561/
Threat name:
Shortcut.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2022-05-16 09:57:04 UTC
File Type:
Binary
AV detection:
17 of 41 (41.46%)
Threat level:
  5/5
Result
Malware family:
emotet
Create hunting rule
Score:
  10/10
Tags:
family:emotet botnet:epoch4 banker suricata trojan
Link:
https://tria.ge/reports/220516-lyxk9sahgl/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
An obfuscated cmd.exe command-line is typically used to evade detection.
Checks computer location settings
Loads dropped DLL
Blocklisted process makes network request
Downloads MZ/PE file
Emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
Malware Config
C2 Extraction:
131.100.24.231:80
103.132.242.26:8080
167.172.253.162:8080
149.56.131.28:8080
209.126.98.206:8080
188.44.20.25:443
212.237.17.99:8080
129.232.188.93:443
160.16.142.56:8080
46.55.222.11:443
1.234.2.232:8080
45.235.8.30:8080
185.157.82.211:8080
158.69.222.101:443
185.4.135.165:8080
27.54.89.58:8080
197.242.150.244:8080
153.126.146.25:7080
183.111.227.137:8080
103.75.201.2:443
45.118.115.99:8080
79.137.35.198:8080
172.104.251.154:8080
159.65.88.10:8080
203.114.109.124:443
101.50.0.91:8080
51.254.140.238:7080
206.189.28.199:8080
72.15.201.15:8080
150.95.66.124:8080
201.94.166.162:443
209.97.163.214:443
103.70.28.102:8080
185.8.212.130:7080
216.158.226.206:443
209.250.246.206:443
23.239.0.12:443
164.68.99.3:8080
102.222.215.74:443
134.122.66.193:8080
82.165.152.127:8080
51.91.76.89:8080
189.126.111.200:7080
146.59.226.45:443
163.44.196.120:8080
51.91.7.5:8080
58.227.42.236:80
167.99.115.35:8080
196.218.30.83:443
107.182.225.142:8080
151.106.112.196:8080
91.207.28.33:8080
94.23.45.86:4143
103.43.46.182:443
45.176.232.124:443
5.9.116.246:8080
173.212.193.249:8080
1.234.21.73:7080
212.24.98.99:8080
213.241.20.155:443
110.232.117.186:8080
77.81.247.144:8080
119.193.124.41:7080
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.95
Link:
https://yomi.yoroi.company/submissions/78a7f0a26d5cb1b13b6dc67fdc247fa0f173564651d434ed4c17cdecb7dff561

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Execution_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies execution artefacts in shortcut (LNK) files.
Rule name:EXE_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies executable artefacts in shortcut (LNK) files.
Rule name:PS_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies PowerShell artefacts in shortcut (LNK) files.
Rule name:SUSP_LNK_CMD
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the reference to cmd.exe inside an lnk file, which is suspicious
Rule name:SUSP_PowerShell_Caret_Obfuscation_2
Create hunting rule
Author:Florian Roth
Description:Detects powershell keyword obfuscated with carets
Reference:Internal Research
Rule name:SUSP_PowerShell_Caret_Obfuscation_2_RID347B
Create hunting rule
Author:Florian Roth
Description:Detects powershell keyword obfuscated with carets
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments