MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a297830bd38cf0c467391e2e9fdc280a0be7e8520c7e4691ff52b94356af962a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet (aka Heodo)

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	a297830bd38cf0c467391e2e9fdc280a0be7e8520c7e4691ff52b94356af962a
SHA3-384 hash:	f64b0f61ded2f275486ea52d183fa61bc3f9c793a8a08d68177cb04d51f08b01b2ea89dc1b0eedc8f7a5cee5dd67176d
SHA1 hash:	466c0162c5664dff0ab7a8ab46fed9b3a48e7fd3
MD5 hash:	4cb74cd58957b9da18f38489b475b842
humanhash:	summer-avocado-whiskey-batman
File name:	emotet_exe_e4_a297830bd38cf0c467391e2e9fdc280a0be7e8520c7e4691ff52b94356af962a_2022-01-11__172812.exe
Download:	download sample
Signature	Heodo Create hunting rule
File size:	375'808 bytes
First seen:	2022-01-11 17:28:18 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	b9cdda1d995beb2b24d34dee70d9e4d8 (3 x Heodo)
ssdeep	6144:FtASNjUI7BntCAVFK2WE0JDKX7PJMkQLzSiS1DFSNdOKIm1v8+c/E6CV7:jH371XG2j0Oj3iwD4Cnm1vKe
TLSH	T1C384E142B9D1D036D42F1432215AD7652B3EB520475ECEEBABB40CBB4F3B6D18534A2B
Reporter	Cryptolaemus1
Tags:	dll Emotet epoch4 exe Heodo

Cryptolaemus1

Emotet epoch4 exe

Intelligence

File Origin

# of uploads :

# of downloads :

132

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/218288/

Detection(s):

SecuriteInfo.com.Variant.Fragtor.46441.21246.12431.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a custom TCP request

Launching a process

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

anti-debug greyware packed

Link:

https://www.filescan.io/uploads/61ddbe62e997359713dd6f00/reports/df8c52a3-440b-45fd-ae64-aa0e7b9cf215/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/05bee6b0-63f7-4396-95a0-7a9d0ea195b0

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a297830bd38cf0c467391e2e9fdc280a0be7e8520c7e4691ff52b94356af962a/

Threat name:

Win32.Trojan.Fragtor

Status:

Malicious

First seen:

2022-01-11 17:29:11 UTC

File Type:

PE (Dll)

AV detection:

7 of 43 (16.28%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uklygc6trtymizzzdyxj7xbibif6p2csbr7enep7kk4ugvvpsyva._file

Result

Malware family:

emotet

Score:

10/10

Tags:

family:emotet botnet:epoch4 banker trojan

Link:

https://tria.ge/reports/220111-v2j9saggbm/

Behaviour

Suspicious use of WriteProcessMemory

Emotet

Malware Config

C2 Extraction:

131.100.24.231:80
209.59.138.75:7080
103.8.26.103:8080
51.38.71.0:443
212.237.17.99:8080
79.172.212.216:8080
207.38.84.195:8080
104.168.155.129:8080
178.79.147.66:8080
46.55.222.11:443
103.8.26.102:8080
192.254.71.210:443
45.176.232.124:443
203.114.109.124:443
51.68.175.8:8080
58.227.42.236:80
45.142.114.231:8080
217.182.143.207:443
178.63.25.185:443
45.118.115.99:8080
103.75.201.2:443
104.251.214.46:8080
158.69.222.101:443
81.0.236.90:443
45.118.135.203:7080
176.104.106.96:8080
212.237.56.116:7080
216.158.226.206:443
173.212.193.249:8080
50.116.54.215:443
138.185.72.26:8080
41.76.108.46:8080
212.237.5.209:443
107.182.225.142:8080
195.154.133.20:443
162.214.50.39:7080
110.232.117.186:8080

Unpacked files

SH256 hash:

ae064d96041d1b158048309153d4b944496253e0222d3a89cae442997997eb41

MD5 hash:

e90e415c3fae5d1ef49801766922c726

SHA1 hash:

56caf44e400461406fb29350f355325e2778f2d0

Detections:

win_emotet_a2

win_emotet_auto

Link:

https://www.unpac.me/results/358b2c00-d0cf-4c4d-80bb-1a38ae04ce6b/

SH256 hash:

a297830bd38cf0c467391e2e9fdc280a0be7e8520c7e4691ff52b94356af962a

MD5 hash:

4cb74cd58957b9da18f38489b475b842

SHA1 hash:

466c0162c5664dff0ab7a8ab46fed9b3a48e7fd3

Link:

https://www.unpac.me/results/358b2c00-d0cf-4c4d-80bb-1a38ae04ce6b/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a297830bd38cf0c467391e2e9fdc280a0be7e8520c7e4691ff52b94356af962a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.