MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b5c43726ac6b60ef52f82821006c0bfc97c1fc6e897c4aae306c57e01b3acde4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 7


Intelligence 7 IOCs YARA 10 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b5c43726ac6b60ef52f82821006c0bfc97c1fc6e897c4aae306c57e01b3acde4
SHA3-384 hash: 060d6e8692b8e9da59bcff2433ced004c5ab89e57309bb7a1f8a245372b4b42e095a7e31dee8041bc18352cc6ef6f345
SHA1 hash: 6f6be5d2d61710e6f146b490f70fa01c11300577
MD5 hash: d74b1f44c22da7988580293a12b8f2a5
humanhash: cola-east-stream-twenty
File name:d74b1f44c22da7988580293a12b8f2a5
Download: download sample
Signature Heodo
Create hunting rule
File size:832'001 bytes
First seen:2023-03-19 00:17:50 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:BA/fqQLsh2uoOObj+gmM424czDPECwRAc7cDA08yuMol31:G/fqmm2sObC7ezET7vh731
TLSH T182052368C67295D1DE81E635B5321A09FFDE0791680338EDA4FD6C3D29F0E40973B522
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter zbetcheckin
Tags:Emotet file-pumped Heodo zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
183
Origin country :
n/a
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:VG0srkGsej8U9u5qMqDbfOH8g68F026D.dll
Pumped file This file is pumped. MalwareBazaar has de-pumped it.
File size:530'105'856 bytes
SHA256 hash: 5a8b9be736eb447d3147f48c5d06196b4b937d9eb1627e39c7f780f53ca02030
MD5 hash: b65f280adced3d70e4bb5fc14c57c783
De-pumped file size:574'976 bytes (Vs. original size of 530'105'856 bytes)
De-pumped SHA256 hash: fd79e8fa5e3801101a1305b6aba7a5e7fdc852ed9036d6d9a5210be414a5cc5a
De-pumped MD5 hash: c901c8089c5e017f8e9b4b15c8ef154f
MIME type:application/x-dosexec
Signature Heodo
Vendor Threat Intelligence
Result
Verdict:
Malicious
File Type:
ZIP File - Malicious
Link:
https://app.docguard.net/b5c43726ac6b60ef52f82821006c0bfc97c1fc6e897c4aae306c57e01b3acde4/results/dashboard
Behaviour
SuspiciousEmbeddedObjects detected
Gathering data
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/b5c43726ac6b60ef52f82821006c0bfc97c1fc6e897c4aae306c57e01b3acde4
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/b5c43726ac6b60ef52f82821006c0bfc97c1fc6e897c4aae306c57e01b3acde4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b5c43726ac6b60ef52f82821006c0bfc97c1fc6e897c4aae306c57e01b3acde4/
Threat name:
Win64.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2023-03-19 02:31:49 UTC
AV detection:
11 of 22 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wxcdojvmnnqo6uxyfaqqa3al7sl4d7dorf6evlrqnrl6agz2zxsa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b5c43726ac6b60ef52f82821006c0bfc97c1fc6e897c4aae306c57e01b3acde4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win64_emotet_unpacked
Create hunting rule
Author:Rony (r0ny_123)
Rule name:Emotet
Create hunting rule
Author:kevoreilly
Description:Emotet Payload
Rule name:Emotet_string_hashing
Create hunting rule
Author:Embee_Research @ HuntressLabs
Rule name:PK_PUMP_AND_DUMP
Create hunting rule
Author:Will Metcalf @node5
Description:Walks Zip Central Directory filename entries looking for abused extension then checks for a file that's at least 25M and then check to see how much uncompressed size is vs compressed size
Rule name:TrojanSpy_EMOTET_W4
Create hunting rule
Author:Ian Kenefick (Trend Micro)
Description:Emotet x64 Loader
Rule name:Windows_Trojan_Emotet_77c667b9
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Emotet_8b9449c1
Create hunting rule
Author:Elastic Security
Rule name:win_emotet_a3
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT
Description:detects Emotet through its obfuscation
Rule name:win_emotet_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.emotet.
Rule name:win_heodo
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Heodo

zip b5c43726ac6b60ef52f82821006c0bfc97c1fc6e897c4aae306c57e01b3acde4

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2576659/

Comments


Avatar
zbet commented on 2023-03-19 00:18:19 UTC

url : hxxp://hairmaxsoftware.com/software/D2g/