MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a4b07204b33173093041072e00e88d0083c88b88f634561aabe46ec8992f9332. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a4b07204b33173093041072e00e88d0083c88b88f634561aabe46ec8992f9332
SHA3-384 hash: 691437fa5d999499754d8212bb33124162ab63fbdec0a4a02325124fa00c56ae062f656fd80986135f95199b69c07963
SHA1 hash: f95a110dee743c3d33aa737fbb164c7148c9248c
MD5 hash: e1939d61d59909862e2b058d96fe0789
humanhash: nevada-eleven-single-zebra
File name:z7ZJdF1SfMKAp6L.exe
Download: download sample
Signature Emotet
Create hunting rule
File size:406'528 bytes
First seen:2020-06-08 16:55:05 UTC
Last seen:2020-06-08 18:19:05 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'604 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 6144:ZF//IOQBJKKfKYqLFmXTu9fQPux0R8sXwpgdFGxMOMATHvkEqdqhGIxBdaZ:ZFoqxLFmXT+ffIggfGxTvT0db+AZ
Threatray 487 similar samples on MalwareBazaar
TLSH 7F84124437A8873DE63E07F990F221105772B317B639F69D5DC731DB0BA1B620AA2A47
Reporter James_inthe_box
Tags:Emotet exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection:
M00nD3v
Create hunting rule
Link:
https://www.capesandbox.com/analysis/7119/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader33.51639.28767.28601.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 16:54:48 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
36 of 48 (75.00%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
hawkeyekeylogger
Create hunting rule
emotet
Create hunting rule
Similar samples:
0d4623e27386fcbb4755a97f2552b141f7ffd67b56feea2768c49920bd0b081d
Emotet
2e8f8383cfdb7a42c9e5ced3469619f6154b874616a2dd793693f3b53ec5cae7
Emotet
32e7be2844e7be1f6ae7d262eeebe64926946ebbc8e2d91ce3760b8e1d10285c
Emotet
740ad559a3b83f05776ac9f2c650c3d6268d63848c556770c57a9e6edd9f03f5
Emotet
7d01a97eb5e90a8c74c6a16961ab1a1bff4a1408779e46cf769bb5889d2d44bc
Emotet
c50ba6556752607323e0e14d5429961d9af3804d9b45f8c7755ec1709efc6af3
Emotet
dd1dbd01bac8f1ba75f1279f9684e5f6a706559acaa2db285697c5f5e3258a31
Emotet
dfca8cf09994229afec678b5c279d247e3e69c45f2878f816025b4933f3bc3b0
Emotet
f61fba92541b23921c7904cd689121c68b8bf69780220586227bf01c9816c68d
Emotet
f669e4406244692e23e031d355e53b51dee1b96f1e988172a2b1eabcd0d82292
Emotet
+ 477 additional samples on MalwareBazaar
Result
Malware family:
m00nd3v_logger
Create hunting rule
Score:
  10/10
Tags:
family:m00nd3v_logger rezer0 spyware stealer
Link:
https://tria.ge/reports/201109-w33hqj2lws/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of web browsers
Uses the VBS compiler for execution
M00nD3v Logger Payload
ServiceHost packer
rezer0
M00nd3v_Logger
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
  
URLhaus
https://urlhaus.abuse.ch/url/383449/
Cape
Cape
https://www.capesandbox.com/analysis/7119/

Comments