MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b680156ec148a3ca3a4f0ebde18e88484430a9cd15e0f1ef5e4225a6d2bf00a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 10


Intelligence 10 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b680156ec148a3ca3a4f0ebde18e88484430a9cd15e0f1ef5e4225a6d2bf00a7
SHA3-384 hash: bb03a310f36b52b4fa47f1726372557d59a520ee323f0026ef6e6dbf92a825e2d1266b4643f43f3a9f02ebad71f3b19b
SHA1 hash: b11ef66f099bf5b22eeb0d4cf591b0557ad418fc
MD5 hash: 0ea32a3571b79652137186cdc4af36a7
humanhash: pasta-jersey-xray-golf
File name:b680156ec148a3ca3a4f0ebde18e88484430a9cd15e0f1ef5e4225a6d2bf00a7
Download: download sample
Signature Heodo
Create hunting rule
File size:135'168 bytes
First seen:2021-02-28 21:18:46 UTC
Last seen:2021-02-28 23:07:07 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 3072:hKL4zqfmpBYm2OWm3Px/DJaD2cv5IZzXL+9Zb9:hNquam50WTLw
Threatray 22 similar samples on MalwareBazaar
TLSH 65D35B1963ADDE14E63E067EA4B0630147F091077612EB5A4EE1F8C92F25FC02E74BB6
Reporter c3rb3ru5d3d53c2
Tags:Emotet Heodo


Avatar
c3rb3ru5d3d53c
@c3rb3ru5d3d53c Live Hunt

Intelligence

File Origin
# of uploads :
2
# of downloads :
1'569
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b680156ec148a3ca3a4f0ebde18e88484430a9cd15e0f1ef5e4225a6d2bf00a7
Verdict:
Malicious activity
Analysis date:
2021-02-28 21:19:36 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/5898ff13-df33-4869-9845-6e2f20c555ad

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/120057/
Detection(s):
SecuriteInfo.com.Variant.Bulz.363132.2646.20147.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending an HTTP POST request
DNS request
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Creating a window
Reading critical registry keys
Creating a file in the %temp% directory
Deleting a recently created file
Sending a UDP request
Creating a file
Stealing user critical data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.spyw.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/621481
Signature
Binary contains a suspicious time stamp
Found many strings related to Crypto-Wallets (likely being stolen)
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Uses known network protocols on non-standard ports
Behaviour
Behavior Graph:
Download SVG
Detection:
redlinestealer
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b680156ec148a3ca3a4f0ebde18e88484430a9cd15e0f1ef5e4225a6d2bf00a7/
Threat name:
Win32.Infostealer.ClipBanker
Create hunting rule
Status:
Malicious
First seen:
2021-02-28 21:19:07 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0ebfb9888d15c1377eb933a088f7aa3dd228523ffee36d7f8718c49d976dab6c
Heodo
20510b85596724711f8fb4c7111055086f6e44845206038fa7b7c4bcfebf2265
Heodo
2cd722bc4e448f38f4e79e69a48a7fc3f92c09586e50bc0f3f9f8dc5f4495fcc
Heodo
4d94148f1dff68b03896e3fa5508c5b039b0a29b1fd90db01884137f2e9495a4
Heodo
79d5b3a1a8b602ecb6ffb87e5c42acdaa4403e81cb3dcf859e573392c2350dc0
Heodo
82bd69c7b58c486211c511d719f44cf734ddc90d062431ef366d77f32557b5e6
Heodo
8ad59828630ebb9691c466a275558e87680d02c62b423c9210596c75de2d2c95
Heodo
910ac144ccbde84d9a6946123312c35d8c2291a62a9efc142edd2c59cb8fab15
Heodo
c3e4279a43450ead744ae1ccb4eebce1feb6017ef3a8f2f0a1b3f602922913a0
Heodo
ef9a0bce5286a538e8a405e41aa15b2fe89bb40323558ee88ac14e4f7e81c818
Heodo
+ 12 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery spyware
Link:
https://tria.ge/reports/210228-jam7jjrdba/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Checks installed software on the system
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
b680156ec148a3ca3a4f0ebde18e88484430a9cd15e0f1ef5e4225a6d2bf00a7
MD5 hash:
0ea32a3571b79652137186cdc4af36a7
SHA1 hash:
b11ef66f099bf5b22eeb0d4cf591b0557ad418fc
Link:
https://www.unpac.me/results/e04209c8-366a-4afa-b313-10e1161af4a2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.77
Link:
https://yomi.yoroi.company/submissions/b680156ec148a3ca3a4f0ebde18e88484430a9cd15e0f1ef5e4225a6d2bf00a7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Steam_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Steam in files like avemaria

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://www.virustotal.com/gui/file/b680156ec148a3ca3a4f0ebde18e88484430a9cd15e0f1ef5e4225a6d2bf00a7/details
  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/120057/

Comments