MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b5abacf24ae5aa96016c09f71a78d0121fff396d6154740eab622c4751e1764f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet (aka Heodo)

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	b5abacf24ae5aa96016c09f71a78d0121fff396d6154740eab622c4751e1764f
SHA3-384 hash:	06129a173b2a717ff8587381a6c8bb6af7fed9376202bac10fb48310c20fdada2b5ffe562a9d6bb70c2ecd8390e5243b
SHA1 hash:	909870e8ea76626fbe13e2c960560c2a165bd102
MD5 hash:	dca3f0a3eecf16ac4b72615d712112e9
humanhash:	stairway-diet-xray-comet
File name:	Y77J.dll
Download:	download sample
Signature	Heodo Create hunting rule
File size:	356'696 bytes
First seen:	2021-01-20 18:46:47 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	af263152594d80bd9c18d0a70e4d94ec (26 x Heodo)
ssdeep	3072:oa99Ky1S0SD8MHjO73Ba01/H/7FlwZ2RJJBvX+WUEAQbb:oaGy1nS8MHi7xai73JtkWUEAKb
TLSH	B1749CEAF8BBA814C789F1716BDA6D7399378F33028C61757F542ACE03836D81AD6405
Reporter	malware_traffic
Tags:	dll Emotet epoch1 Heodo

Intelligence

File Origin

# of uploads :

# of downloads :

141

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Emotet

Link:

https://www.capesandbox.com/analysis/113181/

Detection(s):

SecuriteInfo.com.BScope.Trojan.Chanitor.13222.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Connection attempt

Sending an HTTP POST request

Sending a UDP request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b5abacf24ae5aa96016c09f71a78d0121fff396d6154740eab622c4751e1764f/

Threat name:

Win32.Trojan.EmotetCrypt

Status:

Malicious

First seen:

2021-01-20 18:18:03 UTC

AV detection:

22 of 29 (75.86%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wwv2z4sk4wvjmalmbh3ru6gqcip76olnmfkhidvlmiweoupbozhq._file

Result

Malware family:

emotet

Score:

10/10

Tags:

family:emotet botnet:epoch1 banker trojan

Link:

https://tria.ge/reports/210120-z6f9nhdwfa/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Blocklisted process makes network request

Emotet

Malware Config

C2 Extraction:

181.10.46.92:80
2.58.16.88:8080
206.189.232.2:8080
178.250.54.208:8080
167.71.148.58:443
202.134.4.210:7080
187.162.248.237:80
78.206.229.130:80
85.214.26.7:8080
5.196.35.138:7080
1.226.84.243:8080
110.39.162.2:443
185.183.16.47:80
152.231.89.226:80
138.97.60.141:7080
94.176.234.118:443
46.101.58.37:8080
93.146.143.191:80
70.32.84.74:8080
137.74.106.111:7080
80.15.100.37:80
68.183.190.199:8080
154.127.113.242:80
70.32.115.157:8080
12.163.208.58:80
31.27.59.105:80
110.39.160.38:443
68.183.170.114:8080
87.106.46.107:8080
105.209.235.113:8080
185.94.252.27:443
209.236.123.42:8080
60.93.23.51:80
186.177.174.163:80
177.85.167.10:80
111.67.12.221:8080
191.241.233.198:80
149.202.72.142:7080
12.162.84.2:8080
217.13.106.14:8080
197.232.36.108:80
192.232.229.53:4143
143.0.85.206:7080
177.23.7.151:80
213.52.74.198:80
51.255.165.160:8080
181.30.61.163:443
93.149.120.214:80
212.71.237.140:8080
51.15.7.145:80
190.247.139.101:80
188.135.15.49:80
155.186.9.160:80
91.233.197.70:80
95.76.153.115:80
46.43.2.95:8080
152.169.22.67:80
138.197.99.250:8080
104.131.41.185:8080
211.215.18.93:8080
81.215.230.173:443
152.170.79.100:80
190.114.254.163:8080
190.251.216.100:80
201.241.127.190:80
82.208.146.142:7080
172.245.248.239:8080
190.64.88.186:443
192.175.111.212:7080
50.28.51.143:8080
81.17.93.134:80
202.79.24.136:443
190.24.243.186:80
190.162.232.138:80
62.84.75.50:80
190.210.246.253:80
190.45.24.210:80
172.104.169.32:8080
82.48.39.246:80
188.225.32.231:7080
45.16.226.117:443
178.211.45.66:8080
138.97.60.140:8080
122.201.23.45:443
170.81.48.2:80
81.214.253.80:443
80.249.176.206:80
83.169.21.32:7080
46.105.114.137:8080
83.144.109.70:80
191.223.36.170:80
200.75.39.254:80
201.185.69.28:443

Unpacked files

SH256 hash:

e26e4c92f7fda13abff367a9147d63aa2d09b0a87a6b9ac3d10de4dbfe61e8a3

MD5 hash:

cdcd84d1d782e94cff60db893e12449a

SHA1 hash:

3c2e33a67fc8b59c6806edef543a782eaa86118e

Detections:

win_emotet_a2

Link:

https://www.unpac.me/results/7efe964f-74fc-4122-a854-ea4338996068/

Parent samples :

b5abacf24ae5aa96016c09f71a78d0121fff396d6154740eab622c4751e1764f
06040e1406a3b99da60e639edcf14ddb1f3c812993b408a8164285f2a580caaf
4f0aebbe2bd0308a5f20f96491a8c87875b2373da050bb36f8b9fc3200dc8215
b00b0a31d4f9c373d720daa53bedfe7cf57cf4827fa58465cf60923913fc1bb6

SH256 hash:

b5abacf24ae5aa96016c09f71a78d0121fff396d6154740eab622c4751e1764f

MD5 hash:

dca3f0a3eecf16ac4b72615d712112e9

SHA1 hash:

909870e8ea76626fbe13e2c960560c2a165bd102

Link:

https://www.unpac.me/results/7efe964f-74fc-4122-a854-ea4338996068/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/b5abacf24ae5aa96016c09f71a78d0121fff396d6154740eab622c4751e1764f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.