MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b2b76a7fb93453d584dcdca007249ecd75e2448fa3925e2c7abf58564bb69d4c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b2b76a7fb93453d584dcdca007249ecd75e2448fa3925e2c7abf58564bb69d4c
SHA3-384 hash: 58015f37afb78c2ff971b197f23681a10893802312944768417a8c147d79a47d32eb75c5c2a9f81112667c23af803ec1
SHA1 hash: c52bd875e794520c2200d5be4fc2119508c611e6
MD5 hash: 2408212f3ad80e2ac604524ec6f3dfb8
humanhash: bulldog-glucose-carbon-uniform
File name:emotet_exe_e3_b2b76a7fb93453d584dcdca007249ecd75e2448fa3925e2c7abf58564bb69d4c_2020-09-14__092027._exe
Download: download sample
Signature Heodo
Create hunting rule
File size:622'592 bytes
First seen:2020-09-14 09:20:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7762a5f605650a2600f2aed13f89dc19 (20 x Heodo)
ssdeep 6144:z3JvnlFj9jbYAHUQRnmbZb1N/HkGRhO5k/Hf+eLLI7kIOOJWrFrGofH1WN:z3JvlFjRLjRnQb//EGCm/Hf+C1VpO
Threatray 156 similar samples on MalwareBazaar
TLSH E4D48D12BBE5C076D9A242310FD6E771A7F6ED6009318B0723D09F1F7E39A429936B25
Reporter Cryptolaemus1
Tags:Emotet epoch3 exe Heodo


Avatar
Cryptolaemus1
Emotet epoch3 exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Emotet
Create hunting rule
Link:
https://www.capesandbox.com/analysis/59019/
Detection(s):
SecuriteInfo.com.Emotet-FRLB4B4E2489E8D.2823.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Connection attempt
Connection attempt to an infection source
Sending an HTTP POST request to an infection source
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b2b76a7fb93453d584dcdca007249ecd75e2448fa3925e2c7abf58564bb69d4c/
Threat name:
Win32.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2020-09-14 09:22:08 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wk3wu75zgrj5lbg43sqaoje6zv26erepuojf4ld2x5mfms5wtvga._file
Verdict:
malicious
Similar samples:
0018a8706a83a0d14d43fb37b2489cf590f8379021eb46cd592ddfd192ef0592
Heodo
104d0a88586759e08d44a0dcbe022face745c0ab49391d699e3a70a6bb834710
Heodo
393d91f3975bb680d60310202878190fc17bf3487664ee03a77b98040c301e6d
Heodo
3d5a52a49d4d3a1a4b55f37e72b0cbac375d6255bd13dec5f11eff94a20fa508
Heodo
4328690c9c877e2e2cd30f3f5f4cf2a389f3221bde6d94c852abb94e38c92e4f
Heodo
7556a762283e992435f3b174f8c6eb74d7a1c697fa3ff9e9f8834bb2f8a58db5
Heodo
8a788ee273e2690c2b3e9ed424f0e028ab30234bd4094380d4d4891d5a18f2a3
Heodo
8d96dec2c837209904a891baadfa94f3fdb0eaf45cba68a76c0e232a7b2ee1c2
Heodo
eb3bfac552beb247c08364e56a1d5f45b71ef71dc82a3b10c4db3e58121fb7a5
Heodo
f516472fe3de46cdd06511965cd9f1d3958c45268463816e696b069bdd94d101
Heodo
+ 146 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/200914-sm5w77k2hj/
Behaviour
JavaScript code in executable
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Emotet
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b2b76a7fb93453d584dcdca007249ecd75e2448fa3925e2c7abf58564bb69d4c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT
Rule name:win_icondown_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_sisfader_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/59019/

Comments