MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b030f4ef75c8ef13e944f87ec7b700799b5f2906f4f3cb262c0fb1daa3b41865. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 7


Intelligence 7 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b030f4ef75c8ef13e944f87ec7b700799b5f2906f4f3cb262c0fb1daa3b41865
SHA3-384 hash: d527be30c541704ead3f3512a1f4e0fb1aba3d8da078cbfa4cd19b69fef21f0d767b5df7e34bd168cd94186db68f4429
SHA1 hash: b25512e978cd4b0f700f655caff2923a4c77fdba
MD5 hash: cde1a4983674221e32035465ff72c577
humanhash: ten-carpet-alabama-carpet
File name:uDXTYEs4Lx95sq9d8ACNEDJylh.zip
Download: download sample
Signature Heodo
Create hunting rule
File size:981'830 bytes
First seen:2023-03-24 12:49:16 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:6kf5dOzheNdckFRKluvnRHXdhbDHfXZX1EKdxKmSTH4deI:pXzNdfKluvnRHthzfoYxJlR
TLSH T1332523E059F82941CD0E0C35F92A71BD92BC31666EDD15E633BC3CE5A90EF6C42122B6
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter JAMESWT_WT
Tags:Emotet file-pumped Heodo zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
216
Origin country :
IT IT
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:I7BUGMOAp1mnW79z5M0bLi0WI5oFMy2wIqc.dll
Pumped file This file is pumped. MalwareBazaar has de-pumped it.
File size:544'144'896 bytes
SHA256 hash: 5418335875ee09905dc49a03b4b38dbfa70c5902ec022814d45ec028be3b2975
MD5 hash: 8d4ae113a4228abb787118fa7f080f07
De-pumped file size:982'528 bytes (Vs. original size of 544'144'896 bytes)
De-pumped SHA256 hash: a7be3c164ab71078592c85137aa292be0c62903759e7131d59da279ea74dfef0
De-pumped MD5 hash: 2874a769e1c748bb7eb0c122c304b995
MIME type:application/x-dosexec
Signature Heodo
Vendor Threat Intelligence
Result
Verdict:
Malicious
File Type:
ZIP File - Malicious
Link:
https://app.docguard.net/b030f4ef75c8ef13e944f87ec7b700799b5f2906f4f3cb262c0fb1daa3b41865/results/dashboard
Behaviour
SuspiciousEmbeddedObjects detected
Gathering data
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/b030f4ef75c8ef13e944f87ec7b700799b5f2906f4f3cb262c0fb1daa3b41865
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/b030f4ef75c8ef13e944f87ec7b700799b5f2906f4f3cb262c0fb1daa3b41865
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b030f4ef75c8ef13e944f87ec7b700799b5f2906f4f3cb262c0fb1daa3b41865/
Threat name:
Win32.Trojan.Seheq
Create hunting rule
Status:
Malicious
First seen:
2023-03-24 00:37:12 UTC
AV detection:
10 of 36 (27.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=waypj33vzdxrh2ke7b7mpnyapgnv6kig6tz4wjrmb6y5vi5udbsq._file
Result
Malware family:
emotet
Create hunting rule
Score:
  10/10
Tags:
family:emotet botnet:epoch4 banker persistence trojan
Link:
https://tria.ge/reports/230324-p7g4qagd9y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of WriteProcessMemory
Adds Run key to start application
Emotet
Malware Config
C2 Extraction:
213.239.212.5:443
129.232.188.93:443
103.43.75.120:443
197.242.150.244:8080
1.234.2.232:8080
110.232.117.186:8080
95.217.221.146:8080
159.89.202.34:443
159.65.88.10:8080
82.223.21.224:8080
169.57.156.166:8080
45.176.232.124:443
45.235.8.30:8080
173.212.193.249:8080
107.170.39.149:8080
119.59.103.152:8080
167.172.199.165:8080
91.207.28.33:8080
185.4.135.165:8080
104.168.155.143:8080
206.189.28.199:8080
79.137.35.198:8080
103.132.242.26:8080
202.129.205.3:8080
103.75.201.2:443
149.56.131.28:8080
5.135.159.50:443
172.105.226.75:8080
201.94.166.162:443
115.68.227.76:8080
164.90.222.65:443
186.194.240.217:443
153.126.146.25:7080
187.63.160.88:80
209.126.85.32:8080
72.15.201.15:8080
153.92.5.27:8080
167.172.253.162:8080
147.139.166.154:8080
163.44.196.120:8080
183.111.227.137:8080
139.59.126.41:443
164.68.99.3:8080
188.44.20.25:443
94.23.45.86:4143
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b030f4ef75c8ef13e944f87ec7b700799b5f2906f4f3cb262c0fb1daa3b41865

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:PK_PUMP_AND_DUMP
Create hunting rule
Author:Will Metcalf @node5
Description:Walks Zip Central Directory filename entries looking for abused extension then checks for a file that's at least 25M and then check to see how much uncompressed size is vs compressed size
Rule name:Warp
Create hunting rule
Author:Seth Hardy
Description:Warp
Rule name:WarpStrings
Create hunting rule
Author:Seth Hardy
Description:Warp Identifying Strings

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Heodo

zip b030f4ef75c8ef13e944f87ec7b700799b5f2906f4f3cb262c0fb1daa3b41865

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2581176/
  
Delivery method
Distributed via web download

Comments