MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a918b268968b5a10adab11be7cccc5d1993e3bb2fd81b1bff64d3351fe6b0d01. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a918b268968b5a10adab11be7cccc5d1993e3bb2fd81b1bff64d3351fe6b0d01
SHA3-384 hash: 7e86c5889eb9a6b38ae452974f794e85ad791291abe873a649cf5646322ebbbb89b6100fc3a5f2c9d1b96455423620df
SHA1 hash: 65b8963cd65a211eaa837094344bb8b239c275d3
MD5 hash: abc30092aa7f11a4956008b791562f89
humanhash: eighteen-august-helium-equal
File name:emotet_e2_a918b268968b5a10adab11be7cccc5d1993e3bb2fd81b1bff64d3351fe6b0d01_2020-09-15__105306._doc
Download: download sample
Signature Heodo
Create hunting rule
File size:156'445 bytes
First seen:2020-09-15 10:54:13 UTC
Last seen:2020-09-15 19:06:36 UTC
File type:Word file docx
MIME type:application/msword
ssdeep 1536:VCOIDQhDHR4OIDQhDHRdrdi1Ir77zOH98Wj2gpngB+a9z7Qb4HrO4urHA:VzrfrzOH98ipgn7I4HrO4urHA
TLSH A9E3A70926C1994EF33A4E302BD9BAE91852DCF45D9D40673288B7157737B40E9E1BF8
Reporter Cryptolaemus1
Tags:doc Emotet epoch2 Heodo


Avatar
Cryptolaemus1
Emotet epoch2 doc

Intelligence

File Origin
# of uploads :
19
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
TwinWave.EvilDoc.AutoExecSeparateWays.20200818.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.VB.Trojan.VBA.Agent.BHH.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.WelcomeBackEmotetThatsWhyTheyCallItWindowPain.2020717.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.EmotetCROCryLittleSister.20200720.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.EmotetARCROClubbedToDeathKurayamino.20200904.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Using the Windows Management Instrumentation requests
Creating a process with a hidden window
DNS request
Sending an HTTP GET request
Creating a file
Creating a process from a recently created file
Moving a file to the Windows subdirectory
Creating a service
Connection attempt
Sending an HTTP POST request
Enabling autorun for a service
Bypassing of proactive protection methods using Windows Management Instrumentation (WMI)
Launching a process by exploiting the app vulnerability
Detection:
emotet
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a918b268968b5a10adab11be7cccc5d1993e3bb2fd81b1bff64d3351fe6b0d01/
Threat name:
Document-Word.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2020-09-15 10:51:24 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vemle2ewrnnbblnlcg7hztgf2gmt4o5s7wa3dp7wjuzvd7tlbuaq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
macro
Link:
https://tria.ge/reports/200915-v4mcysj5mj/
Behaviour
Suspicious Office macro
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Emotet
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a918b268968b5a10adab11be7cccc5d1993e3bb2fd81b1bff64d3351fe6b0d01

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Heodo

Word file docx a918b268968b5a10adab11be7cccc5d1993e3bb2fd81b1bff64d3351fe6b0d01

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/512849/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/502955/
  
URLhaus
https://urlhaus.abuse.ch/url/492366/
  
URLhaus
https://urlhaus.abuse.ch/url/505246/
  
URLhaus
https://urlhaus.abuse.ch/url/505667/
  
URLhaus
https://urlhaus.abuse.ch/url/510849/
  
URLhaus
https://urlhaus.abuse.ch/url/503883/
  
URLhaus
https://urlhaus.abuse.ch/url/502054/
  
URLhaus
https://urlhaus.abuse.ch/url/510567/
  
URLhaus
https://urlhaus.abuse.ch/url/491504/
  
URLhaus
https://urlhaus.abuse.ch/url/505314/
  
URLhaus
https://urlhaus.abuse.ch/url/494398/

Comments