MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a43e0864905fe7afd6d8dbf26bd27d898a2effd386e81cfbc08cae9cf94ed968. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a43e0864905fe7afd6d8dbf26bd27d898a2effd386e81cfbc08cae9cf94ed968
SHA3-384 hash: f99c5549699b94721d489b948417cb82032d731ef699eb6b5b0cf8d734a2cb8c69380f8be60d5bf26dc174af12a64154
SHA1 hash: 73c17369f2c4e3ce36d4f8917d011dde9a26eb07
MD5 hash: b951629aedffbabc180ee80f9725f024
humanhash: kilo-jig-alabama-leopard
File name:info_9316876362.one
Download: download sample
Signature Heodo
Create hunting rule
File size:300'120 bytes
First seen:2023-03-17 21:02:45 UTC
Last seen:2023-03-22 08:25:19 UTC
File type:Microsoft OneNote (one) one
MIME type:application/octet-stream
ssdeep 3072:Q7pvc2vetOepE76wtghUVkJlD1HUjCu/tewu4UhKg+012FYrQAwNLhbrUzJr9EQ3:Q1veXwtVElijRcwuzKg+NAw3bI/Z+9mX
TLSH T102545B10E78424A3D55D4732665BAD8AA17709737559CE1E038FA38A2FD3BE0EFB0C49
Reporter SI_FalconTeam
Tags:Emotet Heodo one

Intelligence

File Origin
# of uploads :
3
# of downloads :
753
Origin country :
DE DE
Vendor Threat Intelligence
Result
Verdict:
Malicious
File Type:
OneNote File - Malicious
Link:
https://app.docguard.net/a43e0864905fe7afd6d8dbf26bd27d898a2effd386e81cfbc08cae9cf94ed968/results/dashboard
Behaviour
SuspiciousEmbeddedObjects detected
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-vm
Link:
https://www.filescan.io/uploads/6414d588e6d26a096f56fcd2/reports/d72b84ed-fc7d-4bc4-a1a0-49d140061caa/overview
Verdict:
Malicious
Labled as:
One/Downloader.a
Link:
https://www.hybrid-analysis.com/sample/a43e0864905fe7afd6d8dbf26bd27d898a2effd386e81cfbc08cae9cf94ed968
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a43e0864905fe7afd6d8dbf26bd27d898a2effd386e81cfbc08cae9cf94ed968/
Threat name:
Script-JS.Downloader.One
Create hunting rule
Status:
Malicious
First seen:
2023-03-17 14:02:05 UTC
File Type:
Document
AV detection:
11 of 39 (28.21%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uq7aqzeql7t27vwy3pzgxut5rgfc576tq3ubz66arsxjz6ko3fua._file
Result
Malware family:
n/a
Score:
  4/10
Tags:
n/a
Link:
https://tria.ge/reports/230317-zv116sca6w/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Drops file in Program Files directory
Drops file in Windows directory
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a43e0864905fe7afd6d8dbf26bd27d898a2effd386e81cfbc08cae9cf94ed968

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Emotet_OneNote_Delivery_js_Mar23
Create hunting rule
Author:SECUINFRA Falcon Team (@SI_FalconTeam)
Description:Detects Microsoft OneNote files used to deliver Emotet (.js Payload)
Reference:https://twitter.com/bomccss/status/1636746149855121411
Rule name:OneNote_EmbeddedFiles_NoPictures
Create hunting rule
Author:Nicholas Dhaeyer - @DhaeyerWolf
Description:OneNote files that contain embedded files that are not pictures.
Reference:https://blog.didierstevens.com/2023/01/22/analyzing-malicious-onenote-documents/
Rule name:OneNote_magic
Create hunting rule
Author:Stuart Gonzalez
Rule name:SUSP_OneNote
Create hunting rule
Author:spatronn
Description:Hard-Detect One

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Heodo

Microsoft OneNote (one) one a43e0864905fe7afd6d8dbf26bd27d898a2effd386e81cfbc08cae9cf94ed968

(this sample)

  
X
https://twitter.com/SI_FalconTeam/status/1636813222429769738
  
Delivery method
Distributed via e-mail attachment

Comments


Avatar
TomU | I'm still here... til the end commented on 2023-03-19 22:43:09 UTC

b951629aedffbabc180ee80f9725f024 Documenti-1703.one
9e346695bbc4291bc769f98be9e6a5e9 Documenti-1703_content/OneNoteAttachments/output1.js

--- malware config extracted ---
Malware Configuration Extractor: Emotet {
"C2 list": ["22.70.199.198:8080",
"222.135.65.159:7080",
"122.228.37.54:443",
"99.34.28.202:8080",
"10.169.148.185:8080",
"191.143.16.160:8080",
"68.130.79.114:443",
"175.92.194.193:443",
"74.241.224.103:8080",
"236.12.254.103:7080"]
}

--- http traffic URLs ---
1 [Full request URI: hXXp://apps.identrust[.]com/roots/dstrootcax3.p7c]
1 [Full request URI: hXXp://aristonbentre[.]com/slideshow/O1uPzXd2YscA/]
1 [Full request URI: hXXp://asakitreks[.]com/uploads/ce8u7/]
1 [Full request URI: hXXp://attatory[.]com/i-bmail/6AfEa8G0W8NOtUh7hqFj/]
1 [Full request URI: hXXp://bluegdps100.7m[.]pl/app/Ac8wwulKxqZjc/]
1 [Full request URI: hXXp://bvdkhuyentanyen[.]vn/files/TKK8yKdEvyYAbBE5avb/]