MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ea2efa18736f112d702f98119695a08a531cf3b952258cf70366da7ac35edb4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8ea2efa18736f112d702f98119695a08a531cf3b952258cf70366da7ac35edb4
SHA3-384 hash: 4a7543df06d330185d166369f41adbf86cb313795b7747ea6150c74f153a7ecdea265cd0da592cf1ee9e8115b01c4a64
SHA1 hash: 7fe630614db831a5a9859abea45524d808996f9a
MD5 hash: b7f0d0b7f4bca106d9a318288584b4a7
humanhash: december-mobile-equal-four
File name:emotet_e1_8ea2efa18736f112d702f98119695a08a531cf3b952258cf70366da7ac35edb4_2020-09-15__153359._doc
Download: download sample
Signature Heodo
Create hunting rule
File size:190'210 bytes
First seen:2020-09-15 15:36:12 UTC
Last seen:2020-09-15 15:36:36 UTC
File type:Word file docx
MIME type:application/msword
ssdeep 1536:qI491Y2wcI491Y2w+4tcTv8kvjEuJ0dH5L0c4vs3ti18NmIIP4ovlnoR+a9iXljc:A4tcTvjvTY140818tIP4ovpn1jnnPk
TLSH 4404C50927D2584EF33E8E712794AAED1842DCF4999C806732C877657637B40F9E1AF8
Reporter Cryptolaemus1
Tags:doc Emotet epoch1 Heodo


Avatar
Cryptolaemus1
Emotet epoch1 doc

Intelligence

File Origin
# of uploads :
22
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
TwinWave.EvilDoc.AutoExecSeparateWays.20200818.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.VB.Trojan.VBA.Agent.BHH.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.WelcomeBackEmotetThatsWhyTheyCallItWindowPain.2020717.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.EmotetCROCryLittleSister.20200720.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.EmotetARCROClubbedToDeathKurayamino.20200904.UNOFFICIAL
Create hunting rule

Doc.Dropper.EmotetWinMob0920-9636503-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Using the Windows Management Instrumentation requests
Creating a process with a hidden window
DNS request
Creating a file
Creating a process from a recently created file
Moving a file to the Windows subdirectory
Creating a service
Connection attempt
Sending an HTTP POST request
Deleting a recently created file
Possible injection to a system process
Enabling autorun for a service
Launching a process by exploiting the app vulnerability
Sending an HTTP GET request to an infection source
Detection:
emotet
Create hunting rule
Link:
https://mwdb.cert.pl/sample/8ea2efa18736f112d702f98119695a08a531cf3b952258cf70366da7ac35edb4/
Threat name:
Document-Word.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2020-09-15 15:38:06 UTC
File Type:
Document
Extracted files:
26
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=r2ro7imhg3yrfvyc7gars2k2bcstdtz3surfrt3qgzw2plbv5w2a._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
macro
Link:
https://tria.ge/reports/200915-kjgsm92jre/
Behaviour
Suspicious Office macro
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Emotet
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8ea2efa18736f112d702f98119695a08a531cf3b952258cf70366da7ac35edb4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Heodo

Word file docx 8ea2efa18736f112d702f98119695a08a531cf3b952258cf70366da7ac35edb4

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/503831/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/502746/
  
URLhaus
https://urlhaus.abuse.ch/url/505661/
  
URLhaus
https://urlhaus.abuse.ch/url/501282/
  
URLhaus
https://urlhaus.abuse.ch/url/502609/
  
URLhaus
https://urlhaus.abuse.ch/url/510248/
  
URLhaus
https://urlhaus.abuse.ch/url/501274/
  
URLhaus
https://urlhaus.abuse.ch/url/503825/
  
URLhaus
https://urlhaus.abuse.ch/url/503818/
  
URLhaus
https://urlhaus.abuse.ch/url/498396/
  
URLhaus
https://urlhaus.abuse.ch/url/501289/
  
URLhaus
https://urlhaus.abuse.ch/url/500737/
  
URLhaus
https://urlhaus.abuse.ch/url/501294/
  
URLhaus
https://urlhaus.abuse.ch/url/502620/

Comments