MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b75def84d6907e45b5d49294b334f5691628413ba5ddb2c9e22e6d3e56992f63. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b75def84d6907e45b5d49294b334f5691628413ba5ddb2c9e22e6d3e56992f63
SHA3-384 hash: cc7ae53b05f16373f8e993e363b59ab6c8eb025167c5a49290cf200365634618a120d2b7ce1205419b79939f36137637
SHA1 hash: 478ebc666f5cdbbd5020c8dc46ea06c32cf24b6b
MD5 hash: 8276b8d012af8de62e9fb51a491c92d1
humanhash: yankee-london-five-burger
File name:emotet_e2_b75def84d6907e45b5d49294b334f5691628413ba5ddb2c9e22e6d3e56992f63_2020-09-15__090043._doc
Download: download sample
Signature Heodo
Create hunting rule
File size:158'252 bytes
First seen:2020-09-15 09:01:58 UTC
Last seen:2020-09-15 09:02:36 UTC
File type:Word file docx
MIME type:application/msword
ssdeep 1536:CJ0ZsWTJ0ZsWirdi1Ir77zOH98Wj2gpngR+a9xQ54LW06u:5rfrzOH98ipgt+qD6u
TLSH 72F3970A26D1994EF33A4E3027D9AAED1856DCF44D8C44673288BB157737B40E9E1BF8
Reporter Cryptolaemus1
Tags:doc Emotet epoch2 Heodo


Avatar
Cryptolaemus1
Emotet epoch2 doc

Intelligence

File Origin
# of uploads :
59
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
TwinWave.EvilDoc.AutoExecSeparateWays.20200818.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.VB.Trojan.VBA.Agent.BHH.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.WelcomeBackEmotetThatsWhyTheyCallItWindowPain.2020717.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.EmotetCROCryLittleSister.20200720.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.EmotetARCROClubbedToDeathKurayamino.20200904.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Using the Windows Management Instrumentation requests
Creating a process with a hidden window
DNS request
Creating a file
Creating a process from a recently created file
Moving a file to the Windows subdirectory
Creating a service
Connection attempt
Deleting a recently created file
Possible injection to a system process
Enabling autorun for a service
Launching a process by exploiting the app vulnerability
Sending an HTTP GET request to an infection source
Detection:
emotet
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b75def84d6907e45b5d49294b334f5691628413ba5ddb2c9e22e6d3e56992f63/
Threat name:
Document-Word.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2020-09-15 06:26:06 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=w5o67bgwsb7elnouskklgnhvnelcqqj3uxo3fspcfzwt4vuzf5rq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
macro
Link:
https://tria.ge/reports/200915-x3rec4gt9n/
Behaviour
Suspicious Office macro
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b75def84d6907e45b5d49294b334f5691628413ba5ddb2c9e22e6d3e56992f63

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Heodo

Word file docx b75def84d6907e45b5d49294b334f5691628413ba5ddb2c9e22e6d3e56992f63

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/494398/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/495194/
  
URLhaus
https://urlhaus.abuse.ch/url/509746/
  
URLhaus
https://urlhaus.abuse.ch/url/503472/
  
URLhaus
https://urlhaus.abuse.ch/url/499256/
  
URLhaus
https://urlhaus.abuse.ch/url/503595/

Comments