MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b00b0a31d4f9c373d720daa53bedfe7cf57cf4827fa58465cf60923913fc1bb6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 9


Intelligence 9 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b00b0a31d4f9c373d720daa53bedfe7cf57cf4827fa58465cf60923913fc1bb6
SHA3-384 hash: 6172a870ccde338c17c114795bf2896accf6721e6fa3de56ef76b23f3f1fa221b26c5eda814c187bc6d1fab2d1c558de
SHA1 hash: ce60ea865d7f05f290f732725608af87cf5c36cb
MD5 hash: 535808cac3ad2ec6438ea4b2e8704bf6
humanhash: butter-tennis-shade-fish
File name:b00b0a.dll
Download: download sample
Signature Heodo
Create hunting rule
File size:356'696 bytes
First seen:2022-03-04 14:29:25 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash af263152594d80bd9c18d0a70e4d94ec (26 x Heodo)
ssdeep 3072:/a99Ky1S0SD8MHjO73Ba01/H/7FlwZ2RJJBvX+WUEAQbb:/aGy1nS8MHi7xai73JtkWUEAKb
Threatray 3'475 similar samples on MalwareBazaar
TLSH T1D1749CEAF8BBA814C789F1716BDA6D7399378F33028C61757F542ACE03836C81AD6405
Reporter adm1n_usa32
Tags:dll Emotet Heodo

Intelligence

File Origin
# of uploads :
1
# of downloads :
180
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Emotet
Create hunting rule
Link:
https://www.capesandbox.com/analysis/247370/
Detection(s):
Win.Malware.Generic-9822852-0
Create hunting rule

Win.Malware.Generic-9822878-0
Create hunting rule

Win.Ransomware.Emotet-9822990-0
Create hunting rule

Win.Ransomware.Emotet-9822991-0
Create hunting rule

Win.Ransomware.Emotet-9823370-0
Create hunting rule

Win.Ransomware.Emotet-9823373-0
Create hunting rule

Win.Ransomware.Emotet-9823374-0
Create hunting rule

Win.Ransomware.Emotet-9823375-0
Create hunting rule

Win.Ransomware.Emotet-9823377-0
Create hunting rule

Win.Ransomware.Emotet-9823378-0
Create hunting rule

Win.Ransomware.Emotet-9823379-0
Create hunting rule

Win.Ransomware.Emotet-9823380-0
Create hunting rule

Win.Ransomware.Emotet-9823381-0
Create hunting rule

Win.Ransomware.Emotet-9823382-0
Create hunting rule

Win.Ransomware.Emotet-9823383-0
Create hunting rule

Win.Ransomware.Emotet-9823384-0
Create hunting rule

Win.Ransomware.Emotet-9823385-0
Create hunting rule

Win.Ransomware.Emotet-9823387-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Emotet
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9fbb1e02-6a85-4989-9d79-40affe3ade84
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b00b0a31d4f9c373d720daa53bedfe7cf57cf4827fa58465cf60923913fc1bb6/
Threat name:
Win32.Trojan.PinkSbot
Create hunting rule
Status:
Malicious
First seen:
2021-01-20 18:47:41 UTC
File Type:
PE (Dll)
AV detection:
35 of 42 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wafqumou7hbxhvza3kstx3p6pt2xz5ecp6syizopmcjdse74do3a._file
Verdict:
malicious
Label(s):
emotet
Create hunting rule
Similar samples:
536f0ee8d3ed11f29d4b94920b3fe91e4a01c2c669caf7c1116edca2e4885985
Heodo
586952c78bf1cfb12b0660cd22619c2d0605b4f48338a9f0609e55d0359c25b9
Heodo
5a8abd0a2a010f8420d6c20a6c7f77e4fa379be7b02e3cd256c2cea07ba3399d
Heodo
9efe1e6a03e51125c10c04bf56ac92c805628dae68225a7744011be5af004ff3
Heodo
a01c239f34fde6bcc99bf9c509979e3ad981f5d06d248ef63fdd05c3203a3f5c
Heodo
b5abacf24ae5aa96016c09f71a78d0121fff396d6154740eab622c4751e1764f
Heodo
c74d6e39a2c45d27eb09aa59b6e6c15ab9343ca0bcae8f03260caad06fd47e77
Heodo
cadcec1115423afc55eb8b7abacd2ae7a982826012ca79b3ff4e9e363fabf181
Heodo
db256c03c5978a8af2438624fbd133da9b15a6d246223553b4c59234d4a02d03
Heodo
eb229290149fc8888ba22a4af8767223f945d7cf28fefe1dd6ae9c01f53a83ce
Heodo
+ 3'465 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/220304-rt6ahagefm/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Blocklisted process makes network request
Unpacked files
SH256 hash:
e26e4c92f7fda13abff367a9147d63aa2d09b0a87a6b9ac3d10de4dbfe61e8a3
MD5 hash:
cdcd84d1d782e94cff60db893e12449a
SHA1 hash:
3c2e33a67fc8b59c6806edef543a782eaa86118e
Detections:
win_emotet_a2
Create hunting rule
win_emotet_auto
Create hunting rule
Link:
https://www.unpac.me/results/7bfba913-069c-4e77-b073-5325622ad253/
Parent samples :
b5abacf24ae5aa96016c09f71a78d0121fff396d6154740eab622c4751e1764f
06040e1406a3b99da60e639edcf14ddb1f3c812993b408a8164285f2a580caaf
4f0aebbe2bd0308a5f20f96491a8c87875b2373da050bb36f8b9fc3200dc8215
b00b0a31d4f9c373d720daa53bedfe7cf57cf4827fa58465cf60923913fc1bb6
SH256 hash:
b00b0a31d4f9c373d720daa53bedfe7cf57cf4827fa58465cf60923913fc1bb6
MD5 hash:
535808cac3ad2ec6438ea4b2e8704bf6
SHA1 hash:
ce60ea865d7f05f290f732725608af87cf5c36cb
Link:
https://www.unpac.me/results/7bfba913-069c-4e77-b073-5325622ad253/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b00b0a31d4f9c373d720daa53bedfe7cf57cf4827fa58465cf60923913fc1bb6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Emotet
Create hunting rule
Author:kevoreilly
Description:Emotet Payload
Rule name:INDICATOR_KB_CERT_98a04ea05e8a949a4d880d0136794df3
Create hunting rule
Author:ditekSHen
Description:Detects executables signed with stolen, revoked or invalid certificates
Rule name:Win32_Trojan_Emotet
Create hunting rule
Author:ReversingLabs
Description:Yara rule that detects Emotet trojan.
Rule name:win_emotet_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.emotet.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

anyrun
any.run
https://app.any.run/tasks/4e9c4338-6e89-476b-8a15-934e3b51784e
  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/247370/

Comments