MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8f8f21fe9bc655bec9ef76aac2c5d26c5230268d27c21f43d8aab30e9cfff433. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet (aka Heodo)

Vendor detections: 7

Intelligence 7 IOCs YARA 3 File information Comments

SHA256 hash:	8f8f21fe9bc655bec9ef76aac2c5d26c5230268d27c21f43d8aab30e9cfff433
SHA3-384 hash:	314d3da117aa6fe7ea063a5f4a61168a1468258c999d355d934108c579b00cf253204075b900bf17c7d7f688755a1b29
SHA1 hash:	b22c80e4889d0dc4a25651cf2a7dff6f231d7e41
MD5 hash:	1fd7123f03b60d41edc99e0516fc2291
humanhash:	jersey-fifteen-kentucky-johnny
File name:	Wuujmmv2l.bin
Download:	download sample
Signature	Heodo Create hunting rule
File size:	858'624 bytes
First seen:	2020-10-22 06:55:22 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	195dab9a91ce851036d6dd209691ccd0 (58 x Heodo)
ssdeep	12288:wZFfm9WYbWeR2XIl04x8nAPMDWpRvgOhIYWqu7xwT7fH6vueOfc3O:qM9WYL3ioIkgOhIYNf6vueOfc
Threatray	12'066 similar samples on MalwareBazaar
TLSH	D3057B2236C1C073C1B23131865AE77466AAF9325F795ACBABD51B3D5F381C25A3870E
Reporter	JAMESWT_WT
Tags:	Emotet Heodo

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Emotet

Link:

https://www.capesandbox.com/analysis/74495/

Detection(s):

SecuriteInfo.com.BScope.Trojan.Emotet.10337.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Connection attempt

Sending an HTTP POST request

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8f8f21fe9bc655bec9ef76aac2c5d26c5230268d27c21f43d8aab30e9cfff433/

Threat name:

Win32.Trojan.Emotet

Status:

Malicious

First seen:

2020-10-22 06:55:07 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

25 of 29 (86.21%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=r6hsd7u3yzk35sppo2vmfrosnrjdajune7bb6q6yvkzq5hh76qzq._file

Verdict:

malicious

Label(s):

emotet

Result

Malware family:

emotet

Score:

10/10

Tags:

trojan banker family:emotet

Link:

https://tria.ge/reports/201022-el7qdnktsx/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Emotet Payload

Emotet

Malware Config

C2 Extraction:

85.246.78.192:80
188.226.165.170:8080
188.40.170.197:80
51.38.50.144:8080
175.103.38.146:80
192.210.217.94:8080
180.23.53.200:80
202.29.237.113:8080
58.27.215.3:8080
190.85.46.52:7080
36.91.44.183:80
190.164.135.81:80
37.205.9.252:7080
192.241.220.183:8080
5.2.246.108:80
180.21.3.52:80
85.75.49.113:80
190.55.186.229:80
116.91.240.96:80
180.148.4.130:8080
109.13.179.195:80
162.144.145.58:8080
73.55.128.120:80
157.7.164.178:8081
221.147.142.214:80
47.154.85.229:80
8.4.9.137:8080
86.123.55.0:80
213.165.178.214:80
2.58.16.86:8080
172.105.78.244:8080
203.153.216.178:7080
192.163.221.191:8080
115.79.195.246:80
139.59.12.63:8080
54.38.143.245:8080
177.130.51.198:80
45.239.204.100:80
185.63.32.149:80
185.80.172.199:80
172.193.79.237:80
37.46.129.215:8080
103.229.73.17:8080
121.117.147.153:443
118.33.121.37:80
46.32.229.152:8080
119.92.77.17:80
181.59.59.54:80
179.5.118.12:80
73.100.19.104:80
50.116.78.109:8080
190.151.5.131:443
75.127.14.170:8080
41.185.29.128:8080
143.95.101.72:8080
77.74.78.80:443
74.208.173.91:8080
82.78.179.117:443
200.243.153.66:80
120.51.34.254:80
185.142.236.163:443
91.75.75.46:80
212.198.71.39:80
95.76.142.243:80
42.200.96.63:80
126.126.139.26:443
109.206.139.119:80
188.166.220.180:7080
190.192.39.136:80
110.37.224.243:80
172.96.190.154:8080
190.117.101.56:80
123.216.134.52:80
178.33.167.120:8080
37.187.100.220:7080
91.83.93.103:443
60.108.128.186:80
91.213.106.100:8080
125.200.20.233:80
79.133.6.236:8080
185.208.226.142:8080
198.20.228.9:8080
115.79.59.157:80
203.56.191.129:8080
113.203.238.130:80
103.93.220.182:80
5.79.70.250:8080
153.229.219.1:443
139.59.61.215:443
223.17.215.76:80
190.194.12.132:80
41.76.213.144:8080
103.80.51.61:8080
195.201.56.70:8080
46.105.131.68:8080
116.202.10.123:8080
113.161.148.81:80

Unpacked files

SH256 hash:

8f8f21fe9bc655bec9ef76aac2c5d26c5230268d27c21f43d8aab30e9cfff433

MD5 hash:

1fd7123f03b60d41edc99e0516fc2291

SHA1 hash:

b22c80e4889d0dc4a25651cf2a7dff6f231d7e41

Link:

https://www.unpac.me/results/34d47dee-6dd7-4bcc-832a-92a430cebe5c/

SH256 hash:

8598b3f5b2457e8a4386766f7e5848d67dfa6385e8f859eb75c40d036c93b053

MD5 hash:

27ece07cfecb381e26ceefdf932b4048

SHA1 hash:

61418fa306485198c4da83ec7b139745ef71f2cd

Detections:

win_emotet_a2

win_emotet_auto

Link:

https://www.unpac.me/results/34d47dee-6dd7-4bcc-832a-92a430cebe5c/

Parent samples :

be9eb8eed9027a5cd708add6f2d05e842ffb2d0bdf75bacb9755a8cc6a8f2c2e
435a5a3230ab6af23d7caf931bb86f07ffb86721740eb5f6c001e404b1aa1ab6
ff5a2dbce101f73a5e6add762ffcbf6f69f6c24e36566c0ec7d75b32ea269f32
5dd1c600772e7dfec3b70cb2d12f816001b482b6d8627ec5aabb5b00f4542c57
8f8f21fe9bc655bec9ef76aac2c5d26c5230268d27c21f43d8aab30e9cfff433
1ac1aefc50020f47986cae6cf2273a7849dd4ea93b9fa5e54ca94c6fce88093e
0396f8264ba158984334730672acc3fa4f5cf20af65406f97f7dea33db2434bd
0a58b4730f1ff0aed5055237176434e7b5b793dd27d7cf478196a2b5049bab59
2a8a8812cccea1553d6859cd9c26c9ac4213c968a941ff7d0ec1a6fd8f3fccf6
ee038b3caf19c2c2259aec975af5e11ea32eb48cf8e5c4f02598310d0c568279
0d70c99e4d2e776a5640b17904ad6fce6f681fb384fbb9eaa42c0a73d2c51527
4ee8761f06109cb1e911de810c2dccea2205fdde65320d390b4f52ec60b4c423

SH256 hash:

8e7f4168697db1f7f2aa2aaccfd4744792ceae50f57e1a139287033b9f672ef1

MD5 hash:

eb780b43a42fa153d0e5d8416c92e9c4

SHA1 hash:

c542888aa6fd60147057a263f301124217c42cbf

Detections:

win_emotet_a2

win_emotet_auto

Link:

https://www.unpac.me/results/34d47dee-6dd7-4bcc-832a-92a430cebe5c/

Parent samples :

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Cobalt_functions Create hunting rule
Author:	@j0sm1
Description:	Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

Rule name:	Win32_Trojan_Emotet Create hunting rule
Author:	ReversingLabs
Description:	Yara rule that detects Emotet trojan.

Rule name:	win_sisfader_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator