MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a4e1a5b0197b59eb99538327584f8294e81259fd704c281469ec6b7ab7a2c046. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a4e1a5b0197b59eb99538327584f8294e81259fd704c281469ec6b7ab7a2c046
SHA3-384 hash: c33a2081f8d81b62335c926a0fd27bfbd00bebaf981e79f8a1cd1e6e80d8ac2adacfa575e354658ae97f74b38a06301b
SHA1 hash: a57eca6cdaac12f2b4b523110bc2bf338f4c109a
MD5 hash: 4d4b1ea836e736d7f9e1d66b35c0aa94
humanhash: magnesium-kansas-hot-april
File name:4d4b1ea836e736d7f9e1d66b35c0aa94.exe
Download: download sample
Signature Emotet
Create hunting rule
File size:5'410'089 bytes
First seen:2021-01-15 15:43:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 223d0574dd598bea0ae79630c48ebf80 (3 x Emotet, 1 x DemonWare, 1 x CobaltStrike)
ssdeep 98304:AzAMqieNQl44/kxMX0Mz5WW/TU4POqIFK81slGHbCKR0xPjm0bZ+JU2CS4KjMe9n:cf4NQl4Ik+M8I4GA81G+Loa0Eu2ge9Lj
Threatray 23 similar samples on MalwareBazaar
TLSH 18463370F885C0F7E1F6483918F0E5B9A9ADFD359775061FE368323C4DB12E21426AA9
Reporter abuse_ch
Tags:Emotet exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
190
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
87e8ff5c51e0.xls
Verdict:
Malicious activity
Analysis date:
2021-01-15 07:40:02 UTC
Tags:
macros
Link:
https://app.any.run/tasks/74dec122-c1db-4888-b58c-7bbbf4c37136

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/112233/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.43922774.20148.4061.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
DNS request
Sending a custom TCP request
Creating a file
Creating a process from a recently created file
Deleting a recently created file
Sending an HTTP GET request
Enabling the 'hidden' option for recently created files
Setting a keyboard event handler
Setting a global event handler
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/582607
Signature
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a4e1a5b0197b59eb99538327584f8294e81259fd704c281469ec6b7ab7a2c046/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-15 15:44:09 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
emotet
Create hunting rule
Similar samples:
0f4238a14d0c6dbd53c84513df03d0d3be5f8452aa858e2273788690fe7c59dc
Emotet
1b87f2ef8a0150578ab639316e6f392ccac181c9fa18df5a04ccc56963644d02
Emotet
2b6160a9720ed2cf3b818dafc81e4f092111d4df2e0db161b994b39a5ceb78f3
Emotet
2c9a56116d34514c98f71a77cd80ab3b32d6523b2d7aa9b89b6e4f5c1cd8a8df
Emotet
434ea880ad59cffded73a776f3a01a75e6afef21fc6dca45b364fd3f0ba54de3
Emotet
4970f05913aa3f02abc082a82fbf8cf2fc36995b898786cde396b93dce74b859
Emotet
54446099158a525a638b624d85af6d3530970e9050a8b34d4130d1fbbad2dba3
Emotet
95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93
Emotet
bd7fc202d7669e5274554be14461ce65913e388c14500a3e774b1fe9d8d08700
Emotet
f29a85a0a8d5c438141903be9402dfea15cc0eb89e356da5b53d31edfabed15e
Emotet
+ 13 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
pyinstaller
Link:
https://tria.ge/reports/210115-6qxapehzlj/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Detects Pyinstaller
JavaScript code in executable
Looks up external IP address via web service
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
cbada96cf9bc51836a8366faa4abac2994e808622c3f6d1e319db461ac968a4e
MD5 hash:
d788e42d5952fe22f436ad562a6bb6d4
SHA1 hash:
dcfd5d81312d579c4b590bd87e44daee35be186a
Link:
https://www.unpac.me/results/4841321c-a927-4178-adde-7a0e25c40abb/
SH256 hash:
a2e95a16454fd0521fb487ce5f51ed77989fb19bff40c379ac7c700af5760bcd
MD5 hash:
8f1220924021dc0211abc27d7aad45ce
SHA1 hash:
e5fb2765e9de57f9afef997e395cda5f448cdc45
Link:
https://www.unpac.me/results/4841321c-a927-4178-adde-7a0e25c40abb/
SH256 hash:
5140465e19cbb33e255cd735bdc7ba1a5360af8d1fe3cb3737eb50641a244ad7
MD5 hash:
e91b03e6c4f29f785673f15be7f3bf82
SHA1 hash:
d85855922fb42281d15a76d0d0f37d8b9424aa51
Link:
https://www.unpac.me/results/4841321c-a927-4178-adde-7a0e25c40abb/
SH256 hash:
88e8e6b19b075b6b0c4fd42cb3c2ec2ff23962eb24a746d8904f1a0879cbff5e
MD5 hash:
f901161c3753e4ba4282173839cc4c14
SHA1 hash:
a6c4a19030a1824d951bc6870c5c42dcf0fd1d34
Link:
https://www.unpac.me/results/4841321c-a927-4178-adde-7a0e25c40abb/
SH256 hash:
c7c640c385106ec046c8c44ea2fb3b3d8f4a7293c249de3ac86990e839c1406c
MD5 hash:
ca40f608706b3425d623e1ed855d4b77
SHA1 hash:
8ba4fdc5908922e599c57043f1d150d27831dd6b
Link:
https://www.unpac.me/results/4841321c-a927-4178-adde-7a0e25c40abb/
SH256 hash:
b28d3b81251662703d2aee27f009f7a15e8684cd4388837b64b61d9608825430
MD5 hash:
42ddf1811b1f2ff1e3e27606d718bb32
SHA1 hash:
42c7348aef144d1dfdfc2b1fa818b46c73d9f8aa
Link:
https://www.unpac.me/results/4841321c-a927-4178-adde-7a0e25c40abb/
SH256 hash:
597b53ac413efcddce1a1b9c3cb9bdc46cffa79b39b35d01f7b5e654436e6505
MD5 hash:
6bfe8949b0f3d9cf9fbfbf9d1cab32f9
SHA1 hash:
1f6718bc2587cfcdf656b65237d5e3a640ca31a0
Link:
https://www.unpac.me/results/4841321c-a927-4178-adde-7a0e25c40abb/
SH256 hash:
68941e870a469099bb45c7d808aa829861fda35c2063a43ed5222ce09e99c4a0
MD5 hash:
7b202d85fbd4409abd617d2545eee5c4
SHA1 hash:
0a0ef44049c43db447eb9e410fcdbd3412f3bcd3
Link:
https://www.unpac.me/results/4841321c-a927-4178-adde-7a0e25c40abb/
SH256 hash:
c0dfcc76c3a5f92628567490ddcb23f52eaf2d13c96b19514c9c35de56cb7903
MD5 hash:
a496a692119f555e19f7afa14656bc18
SHA1 hash:
3ca28a46ce04eebbe01321591d1ee063fb2ac7b1
Link:
https://www.unpac.me/results/4841321c-a927-4178-adde-7a0e25c40abb/
SH256 hash:
de2e8af7ce1beb041d7fc485953fb66930194b95955cf458bbf76c46db237fe6
MD5 hash:
ea008af01fedc159321bdf557ee93eac
SHA1 hash:
9ce96a44583cb8b3d58a1a3f36b3fd556e7f9a8b
Link:
https://www.unpac.me/results/4841321c-a927-4178-adde-7a0e25c40abb/
SH256 hash:
a4e1a5b0197b59eb99538327584f8294e81259fd704c281469ec6b7ab7a2c046
MD5 hash:
4d4b1ea836e736d7f9e1d66b35c0aa94
SHA1 hash:
a57eca6cdaac12f2b4b523110bc2bf338f4c109a
Link:
https://www.unpac.me/results/4841321c-a927-4178-adde-7a0e25c40abb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a4e1a5b0197b59eb99538327584f8294e81259fd704c281469ec6b7ab7a2c046

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PE_File_pyinstaller
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Description:Detect PE file produced by pyinstaller
Reference:https://isc.sans.edu/diary/21057
Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Emotet

Executable exe a4e1a5b0197b59eb99538327584f8294e81259fd704c281469ec6b7ab7a2c046

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/962500/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/112233/

Comments