MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a9aa662c3360e1faf6a3e72f04a3940fa992c9c21ae422ef2851d4f52221ff9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet (aka Heodo)

Vendor detections: 10

Intelligence 10 IOCs YARA File information Comments

SHA256 hash:	7a9aa662c3360e1faf6a3e72f04a3940fa992c9c21ae422ef2851d4f52221ff9
SHA3-384 hash:	57ccb166e6cea7b62627f56ca14d61c5263f845a5cc61cbb6d5ab47be1e10b8113fab5ce26d5e6711953ad0ca0efbdc3
SHA1 hash:	c2aab156d2709b13498fa21ce74d8f90294919ff
MD5 hash:	ea7b523f7bbd513074199f0112123163
humanhash:	saturn-florida-december-princess
File name:	S.dll
Download:	download sample
Signature	Heodo Create hunting rule
File size:	258'560 bytes
First seen:	2021-11-16 13:11:06 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	822ae775303d14fd9c529b33f0deaf77 (124 x Heodo)
ssdeep	6144:9ks3h7Usv9KgNXyyPSkDTQhJh1WTB5YCa:9kMgwWyqkDT0WTf7a
Threatray	54 similar samples on MalwareBazaar
TLSH	T19744CF01B280A072D9FF193A45F5C66A49BC7A500F90DDCF639849BE5F725C2B6309EE
Reporter	Anonymous
Tags:	dll Emotet Heodo

Intelligence

File Origin

# of uploads :

# of downloads :

118

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Emotet

Link:

https://www.capesandbox.com/analysis/206435/

Detection(s):

Win.Malware.Generic-9909860-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %AppData% subdirectories

Moving a file to the %AppData% subdirectory

Replacing files

Deleting a recently created file

Creating a file

Creating a file in the %temp% directory

Sending a custom TCP request

Sending a UDP request

Moving a recently created file

Creating a file in the Windows subdirectories

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/6193ae264912a8c920a03cbf/reports/9cd83c7d-4773-4c5f-921a-1fa7110cc158/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/eb16537c-b5f3-48b9-933f-d441e62fb681

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7a9aa662c3360e1faf6a3e72f04a3940fa992c9c21ae422ef2851d4f52221ff9/

Threat name:

Win32.Trojan.Emotet

Status:

Malicious

First seen:

2021-11-16 13:12:06 UTC

AV detection:

22 of 28 (78.57%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=pknkmywdgyhb7l3khzzpasrzid5jsle4egxeelxsquou6urcd74q._file

Result

Malware family:

emotet

Score:

10/10

Tags:

family:emotet botnet:epoch4 banker trojan

Link:

https://tria.ge/reports/211116-qfjc5sdhc8/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Blocklisted process makes network request

Emotet

Malware Config

C2 Extraction:

81.0.236.93:443
94.177.248.64:443
66.42.55.5:7080
103.8.26.103:8080
185.184.25.237:8080
45.76.176.10:8080
188.93.125.116:8080
103.8.26.102:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080