MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 91c3af356538ebda04d12492c0beb6df24ae786624f5e21d1dcd4407647be0a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet (aka Heodo)

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	91c3af356538ebda04d12492c0beb6df24ae786624f5e21d1dcd4407647be0a5
SHA3-384 hash:	9f2a4cc60159193dc5f10bd0d5da4b7fc076edf872bae3fdcac60ab51eb855d062f5e9c250769145323f2c0a86f00536
SHA1 hash:	7240833dca6d4e0c1e758736cf5c90b93504ac50
MD5 hash:	4f7adcceab561eb08d621b88c99b9fca
humanhash:	one-lactose-robert-sixteen
File name:	emotet_exe_e4_91c3af356538ebda04d12492c0beb6df24ae786624f5e21d1dcd4407647be0a5_2022-02-24__000212.exe
Download:	download sample
Signature	Heodo Create hunting rule
File size:	679'936 bytes
First seen:	2022-02-24 00:02:21 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	5529db874583b5635436baabaebb4b71 (137 x Heodo)
ssdeep	12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKHe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKHLzflBkn
Threatray	2'597 similar samples on MalwareBazaar
TLSH	T1A1E4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202
File icon (PE):
dhash icon	ce87a3b3c6c6cce8 (281 x Heodo)
Reporter	Cryptolaemus1
Tags:	dll Emotet epoch4 exe Heodo

Cryptolaemus1

Emotet epoch4 exe

Intelligence

File Origin

# of uploads :

# of downloads :

165

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Emotet

Link:

https://www.capesandbox.com/analysis/243998/

Detection(s):

SecuriteInfo.com.BehavesLike.Win32.Dropper.jh.29672.4310.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a custom TCP request

Sending an HTTP GET request

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

control.exe evasive greyware keylogger packed shell32.dll

Link:

https://www.filescan.io/uploads/6216cb50ac8ad0468b6e316b/reports/ee8f76c7-6309-4b61-bd76-c2533da52bf2/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Emotet

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/60cb31f1-1755-48d0-807d-966617693e5d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/91c3af356538ebda04d12492c0beb6df24ae786624f5e21d1dcd4407647be0a5/

Threat name:

Win32.Trojan.Emotet

Status:

Malicious

First seen:

2022-02-24 00:39:32 UTC

AV detection:

24 of 28 (85.71%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=shb26nlfhdv5ubgresjmbpvw34sk46dget26ehi5zvcaozd34csq._file

Verdict:

malicious

Label(s):

emotet

Heodo

8381fa23294905d8d407639c2c0bec09338f62ea782c7c1f8166572512e73e9e

Heodo

9fa6552a0872f1d67ef27ff06ce54f892157654e4c1ca3b59380724154195d7b

Heodo

bd57d24afb51fc0791dedfc035755d526788ad9c5f03147ee04ef6ec55f3c698

Heodo

c100e1cb1eeb64b1937f5445c186433a2338e635216b46ce42810c38dfd65951

Heodo

d38a2f0890814e745e9c2f5ebc00ba9c241f7affce6c465151394eeba7d9a63b

Heodo

fc6d4a1c6eb71dfc72fd7b214e267b9f3eb8f30e8c69438a87310f9833e50b81

Heodo

+ 2'587 additional samples on MalwareBazaar

Result

Malware family:

emotet

Score:

10/10

Tags:

family:emotet botnet:epoch4 banker suricata trojan

Link:

https://tria.ge/reports/220224-ab3cfschgp/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of WriteProcessMemory

Drops file in System32 directory

Emotet

suricata: ET MALWARE W32/Emotet CnC Beacon 3

Malware Config

C2 Extraction:

135.148.121.246:8080
213.190.4.223:7080
175.107.196.192:80
46.55.222.11:443
153.126.203.229:8080
138.185.72.26:8080
45.118.135.203:7080
107.182.225.142:8080
195.154.133.20:443
79.172.212.216:8080
129.232.188.93:443
50.30.40.196:8080
131.100.24.231:80
58.227.42.236:80
216.158.226.206:443
45.118.115.99:8080
51.254.140.238:7080
173.212.193.249:8080
110.232.117.186:8080
81.0.236.90:443
158.69.222.101:443
103.75.201.2:443
185.157.82.211:8080
176.104.106.96:8080
82.165.152.127:8080
156.67.219.84:7080
212.237.17.99:8080
178.128.83.165:80
162.243.175.63:443
45.142.114.231:8080
103.134.85.85:80
178.79.147.66:8080
31.24.158.56:8080
103.75.201.4:443
217.182.143.207:443
159.8.59.82:8080
164.68.99.3:8080
209.126.98.206:8080
207.38.84.195:8080
119.235.255.201:8080
212.24.98.99:8080
212.237.56.116:7080
50.116.54.215:443
45.176.232.124:443
203.114.109.124:443

Unpacked files

SH256 hash:

91c3af356538ebda04d12492c0beb6df24ae786624f5e21d1dcd4407647be0a5

MD5 hash:

4f7adcceab561eb08d621b88c99b9fca

SHA1 hash:

7240833dca6d4e0c1e758736cf5c90b93504ac50

Link:

https://www.unpac.me/results/9b527e12-ca9f-4f97-9595-96152dd5bb0c/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/91c3af356538ebda04d12492c0beb6df24ae786624f5e21d1dcd4407647be0a5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.