MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b1e6ff6c993fe946c595462d560fe059d739a7f6f634e6d7080b71afa7176366. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b1e6ff6c993fe946c595462d560fe059d739a7f6f634e6d7080b71afa7176366
SHA3-384 hash: 9c5d6347486e970a564970b3cde09d5858108a7587da93c82d50bf0990908f548d94e2189374825e6e8aa871e3339e5a
SHA1 hash: aa2b5a2fdfcd925f6a5b71b55159e6225f0af24a
MD5 hash: b64260b7853ea3c30c8762c372e83a28
humanhash: sodium-tennessee-four-item
File name:emotet_exe_e4_b1e6ff6c993fe946c595462d560fe059d739a7f6f634e6d7080b71afa7176366_2021-12-01__202755.exe
Download: download sample
Signature Heodo
Create hunting rule
File size:472'064 bytes
First seen:2021-12-01 20:28:01 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 171ec87b04dbf6cc5aa2b57f2bec0e02 (11 x Heodo)
ssdeep 12288:bRCSNg9VtfjQRVcVTd4qoxHbGeJsjqyP79iAM7/3+/Z1:NCh5sQTgxsjqUinE
Threatray 118 similar samples on MalwareBazaar
TLSH T186A4BF50F942C471D9AE11303869F6EA063D7D204FA589EB77D42F3E4E312C1AB3966B
Reporter Cryptolaemus1
Tags:dll Emotet epoch4 exe Heodo


Avatar
Cryptolaemus1
Emotet epoch4 exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/210461/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
DNS request
Launching a process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/61a7dad986bf67e7121e1523/reports/6d243519-2ce2-484c-b7ed-70953aa36ca8/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/26db8d57-d3a1-4249-8c91-339a1cc2caff
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b1e6ff6c993fe946c595462d560fe059d739a7f6f634e6d7080b71afa7176366/
Threat name:
Win32.Trojan.Emotetcrypt
Create hunting rule
Status:
Malicious
First seen:
2021-12-01 20:28:13 UTC
File Type:
PE (Dll)
Extracted files:
4
AV detection:
25 of 28 (89.29%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
emotet
Create hunting rule
Similar samples:
0154c5dc4d578ef24731afff8e710f01898e2f9da01630228d9b28694def81ab
Heodo
208939e34f46846c7c95383c6fea7813038b4dea87ea3819c157ccfbbf8aa09a
Heodo
71c757b64ebe1e23c86de7c44b7183049f7305d822c2fc5c3617dbe9828fbbce
Heodo
75d3c6f090ebfe864f62727b0cad276f242b464a82360121479172623075445a
Heodo
932b5e1683b32ff36675a9cb16cad8a0b4ca943a61382fda7492e7df4a8283bc
Heodo
af31d877aa581734119ee4515e4a8ccbf2f460df3a3d79dfb1b9d86618738b24
Heodo
c1672fb4596b8168953bc1d93fb20c671d3df84ac836b459e7774188c0c7648e
Heodo
c9126700302e3f650e51a8cdaa7f3e56395c8c58bee4d0a931db7b91aa44d0a3
Heodo
ee3aff7826942d1670f0179bfe88bc1dfbe1c5cc0e6e4c1fcb6ff36d378794e5
Heodo
f02516a2b11b881079dc29fa46dd1c339c8b2b2e5f19017dfa802ceacc9bb9cf
Heodo
+ 108 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/211201-y813naagh9/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
d5fb0df4dee33917094853a494dc33195b32d0b30471a29cd4da4238fbf61a26
MD5 hash:
b946c0e2ad7951704862a60efdf1e7bd
SHA1 hash:
7df014719fe691c14942ebca4ab18c2fe3db3cfd
Detections:
win_emotet_a2
Create hunting rule
win_emotet_auto
Create hunting rule
Link:
https://www.unpac.me/results/07821a62-21b7-43ee-a907-b66da8bad179/
SH256 hash:
b1e6ff6c993fe946c595462d560fe059d739a7f6f634e6d7080b71afa7176366
MD5 hash:
b64260b7853ea3c30c8762c372e83a28
SHA1 hash:
aa2b5a2fdfcd925f6a5b71b55159e6225f0af24a
Link:
https://www.unpac.me/results/07821a62-21b7-43ee-a907-b66da8bad179/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b1e6ff6c993fe946c595462d560fe059d739a7f6f634e6d7080b71afa7176366

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Heodo

DLL dll b1e6ff6c993fe946c595462d560fe059d739a7f6f634e6d7080b71afa7176366

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/210461/
  
URLhaus
https://urlhaus.abuse.ch/url/1842656/
  
Delivery method
Distributed via web download

Comments