MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad76fe813511ecb172097c7a5920aaadc311c597940b7453f93a6b7c0633dcdd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet (aka Heodo)

Vendor detections: 3

Intelligence 3 IOCs YARA 2 File information Comments

SHA256 hash:	ad76fe813511ecb172097c7a5920aaadc311c597940b7453f93a6b7c0633dcdd
SHA3-384 hash:	6bfd0613c4757134a6ad89a25d326c869561a3691d09b30545249ab390091da099aa368ab1b2dcfa5d2b5d822f44ef24
SHA1 hash:	6f8421c997356ec960afb49b7b689a9a5a9d69ac
MD5 hash:	686786d64b3550984c8400beb188e9fb
humanhash:	texas-alaska-east-timing
File name:	ad76fe813511ecb172097c7a5920aaadc311c597940b7453f93a6b7c0633dcdd
Download:	download sample
Signature	Heodo Create hunting rule
File size:	217'088 bytes
First seen:	2020-03-23 18:43:42 UTC
Last seen:	2020-03-24 07:37:39 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	c4a5f5c8a1a46b3e9127a189e06d00ff (1 x Heodo)
ssdeep	3072:fPAPRQQIAeQ6lN1UvG1Pa+QeybOUvercUo0rVKsqEnZIddj2V:nLQ0Q6n1t5QkVW0roouddj
Threatray	26 similar samples on MalwareBazaar
TLSH	4024BE8FD2E5B460FC1D0CFF59635D764BBAAEA2FE3A2948D5B71C03C52596328B0604
Reporter	Marco_Ramilli
Tags:	Emotet exe Heodo

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Win.Trojan.Emotet-6518231-0

Gathering data

Threat name:

Win32.Trojan.Emotet

Status:

Malicious

First seen:

2018-04-25 20:02:15 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

41 of 45 (91.11%)

Threat level:

5/5

Verdict:

malicious

Label(s):

emotet

dridex

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Emotet Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Emotet in memory
Reference:	internal research

Rule name:	win_emotet_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Heodo

exe ad76fe813511ecb172097c7a5920aaadc311c597940b7453f93a6b7c0633dcdd

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/7433/

URLhaus

https://urlhaus.abuse.ch/url/6855/

URLhaus

https://urlhaus.abuse.ch/url/6854/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Reviews

ID	Capabilities	Evidence
MULTIMEDIA_API	Can Play Multimedia	MSVFW32.dll::ICSeqCompressFrameStart
RPC_API	Can Execute Remote Procedures	RPCRT4.dll::RpcMgmtEpEltInqBegin
WIN_CRYPT_API	Uses Windows Crypt API	ADVAPI32.dll::CryptAcquireContextW
WIN_TIME_API	Can Modify Time	KERNEL32.dll::SetSystemTimeAdjustment
WIN_USER_API	Performs GUI Actions	USER32.dll::EmptyClipboard

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample