MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a69719f8d5dd3a3725521d32e16623be5f39aa5731a12061cb3e08793c2c66ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a69719f8d5dd3a3725521d32e16623be5f39aa5731a12061cb3e08793c2c66ba
SHA3-384 hash: 13801b6bdbbdc2dec9cb16a29f1014e054945d0357b08e05d43681398aca90aca59de8d4760ff66b16f4f612587c9db6
SHA1 hash: fd6e3b35b1059108d92d34660b0c54205d39529b
MD5 hash: 85fd43751333aa5d3b831d3d2fafebb7
humanhash: stream-fanta-florida-fix
File name:abb556b6e45931b1e27b40f9f5f610dea7c4e59c13a4299899b022d9
Download: download sample
Signature Heodo
Create hunting rule
File size:1'163'264 bytes
First seen:2023-10-14 02:07:56 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 24576:+tncpVGPS3Hj74zrIbOCFd7m1+DfxQSSTooZVwn3/V4XCAXBv:DpUPS3D8zEbOw7m18ZptMCK
Threatray 1 similar samples on MalwareBazaar
TLSH T13635126036C9C536D6AE163784BB8B642A26BC361B35D0CF77943D6D9D302D3AD38346
TrID 98.2% (.MSI) Microsoft Windows Installer (454500/1/170)
1.7% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter r3dbU7z
Tags:DarkGate Emotet Heodo msi

Intelligence

File Origin
# of uploads :
1
# of downloads :
263
Origin country :
RU RU
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/454249/
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.4517.12082.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Tags:
expand fingerprint installer lolbin packed shell32
Link:
https://www.filescan.io/uploads/6529f80424a90472670a3fdc/reports/3ad9082f-04bf-4852-9fc0-7e5b1573f783/overview
Verdict:
Suspicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/a69719f8d5dd3a3725521d32e16623be5f39aa5731a12061cb3e08793c2c66ba
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/a69719f8d5dd3a3725521d32e16623be5f39aa5731a12061cb3e08793c2c66ba
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
DarkGate, MailPassView
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1325572
Signature
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Contains functionality to modify clipboard data
Deletes shadow drive data (may be related to ransomware)
Found malware configuration
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses known network protocols on non-standard ports
Uses ping.exe to check the status of other devices and networks
Yara detected DarkGate
Yara detected MailPassView
Yara detected WebBrowserPassView password recovery tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1325572 Sample: abb556b6e45931b1e27b40f9f5f... Startdate: 14/10/2023 Architecture: WINDOWS Score: 100 69 Multi AV Scanner detection for domain / URL 2->69 71 Found malware configuration 2->71 73 Antivirus detection for dropped file 2->73 75 9 other signatures 2->75 10 msiexec.exe 8 19 2->10         started        13 Autoit3.exe 2->13         started        16 msiexec.exe 5 2->16         started        process3 file4 61 C:\Windows\Installer\MSIF78B.tmp, PE32 10->61 dropped 63 C:\Windows\Installer\MSI457A.tmp, PE32 10->63 dropped 18 msiexec.exe 5 10->18         started        89 Deletes shadow drive data (may be related to ransomware) 13->89 91 Contains functionality to modify clipboard data 13->91 20 cmd.exe 1 13->20         started        signatures5 process6 signatures7 23 KeyScramblerLogon.exe 4 18->23         started        26 expand.exe 6 18->26         started        28 icacls.exe 18->28         started        30 icacls.exe 18->30         started        81 Deletes shadow drive data (may be related to ransomware) 20->81 process8 file9 53 C:\tmpp\Autoit3.exe, PE32 23->53 dropped 32 Autoit3.exe 21 23->32         started        55 C:\...\7d5db187779e684cb857d2d52e85592e.tmp, PE32 26->55 dropped 57 C:\...\45def06422ad0d4bb438778c21a2573c.tmp, PE32 26->57 dropped 59 (copy), PE32 26->59 dropped process10 dnsIp11 65 185.130.227.202, 2351, 49163, 49164 HOSTKEY-ASNL Netherlands 32->65 49 C:\temp\AutoIt3.exe, PE32 32->49 dropped 77 Deletes shadow drive data (may be related to ransomware) 32->77 79 Contains functionality to modify clipboard data 32->79 37 cmd.exe 7 32->37         started        41 cmd.exe 32->41         started        file12 signatures13 process14 file15 51 C:\ProgramData\ecgdcce\Autoit3.exe, PE32 37->51 dropped 83 Deletes shadow drive data (may be related to ransomware) 37->83 43 cmd.exe 37->43         started        85 Uses ping.exe to check the status of other devices and networks 41->85 46 PING.EXE 41->46         started        signatures16 process17 dnsIp18 87 Deletes shadow drive data (may be related to ransomware) 43->87 67 127.0.0.1 unknown unknown 46->67 signatures19
Score:
35%
Verdict:
Susipicious
File Type:
MSI
Link:
https://malprob.io/report/a69719f8d5dd3a3725521d32e16623be5f39aa5731a12061cb3e08793c2c66ba
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a69719f8d5dd3a3725521d32e16623be5f39aa5731a12061cb3e08793c2c66ba/
Threat name:
Win32.Trojan.DarkGate
Create hunting rule
Status:
Malicious
First seen:
2023-10-14 03:01:16 UTC
AV detection:
5 of 38 (13.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=u2lrt6gv3u5dojksduzoczrdxzpttksxggqsayolhyehspbmm25a._file
Verdict:
malicious
Similar samples:
b79b536569c0060a834e4001289a6700692d67df58e644779fababf0df22fc75
Heodo
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery spyware stealer
Link:
https://tria.ge/reports/231014-ckj9cach86/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Modifies data under HKEY_USERS
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of SetThreadContext
Enumerates connected drives
Drops startup file
Executes dropped EXE
Loads dropped DLL
Modifies file permissions
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Blocklisted process makes network request
Suspicious use of NtCreateUserProcessOtherParentProcess
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a69719f8d5dd/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
DarkGate
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a69719f8d5dd3a3725521d32e16623be5f39aa5731a12061cb3e08793c2c66ba

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_OLE_file_magic_number
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Heodo

Microsoft Software Installer (MSI) msi a69719f8d5dd3a3725521d32e16623be5f39aa5731a12061cb3e08793c2c66ba

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/454249/

Comments