MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b9bdaa0fdb8a01eae676e0276429bbcfa051f9c0ba94abe2229ced6e4b9f6869. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet (aka Heodo)

Vendor detections: 10

Intelligence 10 IOCs YARA 1 File information Comments

SHA256 hash:	b9bdaa0fdb8a01eae676e0276429bbcfa051f9c0ba94abe2229ced6e4b9f6869
SHA3-384 hash:	383a67d8b23bbc89b5fa8363f9ae5e70b2475d6a362fd897a52a96776221529565bf47d97f7e90d896c97c5459a6f466
SHA1 hash:	a5d8c71812349d0e8693426cccdb6f65a5ef5c8b
MD5 hash:	8ff424839540284771bb62878ef6fa0b
humanhash:	bulldog-jupiter-pip-uranus
File name:	emotet_exe_e4_b9bdaa0fdb8a01eae676e0276429bbcfa051f9c0ba94abe2229ced6e4b9f6869_2022-04-04__102412.exe
Download:	download sample
Signature	Heodo Create hunting rule
File size:	868'352 bytes
First seen:	2022-04-04 10:24:18 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	2d2fa1ca6236044d56cef7b752fe5a81 (19 x Heodo)
ssdeep	12288:OBOHvWMwoyDdgp4W5dhdu1sRcwY8b3UHv8qDznxN6t:OX/RgaW5dhc8oHvbzn6
Threatray	1'381 similar samples on MalwareBazaar
TLSH	T1DF059E0675E18477E2BF01310E66777E67FEEA504F205AFB23909A8D4971AC24E3631E
File icon (PE):
dhash icon	71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT)
Reporter	Cryptolaemus1
Tags:	dll Emotet epoch4 exe Heodo

Cryptolaemus1

Emotet epoch4 exe

Intelligence

File Origin

# of uploads :

# of downloads :

214

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/260498/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware2.13193.12495.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a custom TCP request

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

control.exe greyware keylogger shell32.dll

Link:

https://www.filescan.io/uploads/624ac78daa7e43c6a6b5f9cc/reports/073a8a69-d5a5-4d2d-b235-10e3c8a5f0a9/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/bea12d30-8674-4ebc-a4f4-48ea8a705dde

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b9bdaa0fdb8a01eae676e0276429bbcfa051f9c0ba94abe2229ced6e4b9f6869/

Threat name:

Win32.Trojan.Emotet

Status:

Malicious

First seen:

2022-04-03 08:10:29 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

24 of 42 (57.14%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=xg62ud63ria6vztw4atwikn3z6qfd6oaxkkkxyrcttww4s47nbuq._file

Verdict:

malicious

Label(s):

emotet

Heodo

518ab42c509de90d9e32e4dab8fbb488c946b21a05445284f2e3eab6e7fb1011

Heodo

6b79744bedc3e26e588510271b9da7348d8d8bd54cfee2e1f6f21e2dcce9697b

Heodo

7c0e33a5e4e00b3be8e703474e9e9088de96d66e6cc2d85d0fbc83ab1ad79da6

Heodo

8e377c24c906ec195e6161817169f24a069c9cd21af7c52afcc0c987026f8b05

Heodo

db851cae4910a5eac926f5bc2d9a394e70ac036012c1c82a2b46af1daf59df3f

Heodo

+ 1'371 additional samples on MalwareBazaar

Result

Malware family:

emotet

Score:

10/10

Tags:

family:emotet botnet:epoch4 banker suricata trojan

Link:

https://tria.ge/reports/220404-mfyw2shbhr/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of WriteProcessMemory

Drops file in System32 directory

Loads dropped DLL

Emotet

suricata: ET MALWARE W32/Emotet CnC Beacon 3

Malware Config

C2 Extraction:

68.183.94.239:80
104.131.11.205:443
138.197.109.175:8080
187.84.80.182:443
79.143.187.147:443
216.158.226.206:443
167.99.115.35:8080
212.24.98.99:8080
1.234.21.73:7080
206.189.28.199:8080
158.69.222.101:443
164.68.99.3:8080
188.44.20.25:443
185.157.82.211:8080
134.122.66.193:8080
196.218.30.83:443
72.15.201.15:8080
5.9.116.246:8080
176.104.106.96:8080
153.126.146.25:7080
46.55.222.11:443
91.207.28.33:8080
192.99.251.50:443
203.114.109.124:443
51.91.7.5:8080
103.70.28.102:8080
209.250.246.206:443
82.165.152.127:8080
101.50.0.91:8080
151.106.112.196:8080
119.193.124.41:7080
94.23.45.86:4143
51.254.140.238:7080
173.212.193.249:8080
58.227.42.236:80
212.237.17.99:8080
1.234.2.232:8080
45.118.115.99:8080
110.232.117.186:8080
172.104.251.154:8080
159.65.88.10:8080
185.8.212.130:7080
129.232.188.93:443
103.43.46.182:443
103.75.201.2:443
131.100.24.231:80
201.94.166.162:443
45.176.232.124:443
146.59.226.45:443
103.132.242.26:8080
209.126.98.206:8080
197.242.150.244:8080
51.91.76.89:8080
160.16.142.56:8080
176.56.128.118:443
167.172.253.162:8080
189.126.111.200:7080
79.172.212.216:8080
107.182.225.142:8080
50.30.40.196:8080
183.111.227.137:8080

Unpacked files

SH256 hash:

c5308a2f6d0ee631107e9b916d053af12eb9d58db7a6b6fa03258ecfcced451c

MD5 hash:

84e549ee6112336b73e0a5854d0b9957

SHA1 hash:

9b677780244dff6444c7bef6adcdb576984ac115

Detections:

win_emotet_a2

win_emotet_auto

Link:

https://www.unpac.me/results/f5db9f77-2542-41c2-be9e-4946d1dc5ec7/

Parent samples :

6091c051ef109daaed7717b1d6eca23ea5c471e7919d973ce5bec7620e89ddc3
c22bfca7a499ef3ff84978ebef20aa01163cfc0ab182402be47841e326bd0427
316ec392b0d3c0416c47a4c1e4d6a087a3c3985adfb413d9856dd266820c972a
e28a4d0ad5ed65ac2b77383c8899669eae3578cf120a76675071579bbc868ba0
8f891c3c04b4b5203c10eb5bf8700bd10c277b774b5f0ca18e1ab2f8e75e82ea
8933473824bb9402ce42683132b9f3b974f99debebaa0f943261b5f2499ac0d8
7f4cbe8121d97511897445ee4121bca0a3fa8bc5adbd15f8eda6f1124fe31bda
3e7c28eec0699eb8532f1699443c34e36c8a2b9bb402dea78ed374be9ac1aabc
b2218679bbcd4d81b021cf61df66d28dfa7d529c8033df606a82799e7cb0af97
348549f367d0f2f8fa0a02b218311f44b0bd8f9fbb566f4ec153c183d498cdd4
7fd563c97747fbba533245d165b69057df5432c7e39b0104e51f197e6726d902
8e377c24c906ec195e6161817169f24a069c9cd21af7c52afcc0c987026f8b05
7c0e33a5e4e00b3be8e703474e9e9088de96d66e6cc2d85d0fbc83ab1ad79da6
db851cae4910a5eac926f5bc2d9a394e70ac036012c1c82a2b46af1daf59df3f
b9bdaa0fdb8a01eae676e0276429bbcfa051f9c0ba94abe2229ced6e4b9f6869
47c4a587e633b617e6da5801364f14ccb9af1abe91beda0463a1bb18ab263ec8
b57f04c704d4068dbbd39d6c60e0ca99024ad5c898ffd06a18de1b11c42de298
7a2b948dfa606620068203247663247cb95c4a64fde2fa6e522a0a2828027352
493f0a8c0e06eaa673713860c98ad1460119f32f7f2a2faaf2d71c2cedf53387

SH256 hash:

b9bdaa0fdb8a01eae676e0276429bbcfa051f9c0ba94abe2229ced6e4b9f6869

MD5 hash:

8ff424839540284771bb62878ef6fa0b

SHA1 hash:

a5d8c71812349d0e8693426cccdb6f65a5ef5c8b

Link:

https://www.unpac.me/results/f5db9f77-2542-41c2-be9e-4946d1dc5ec7/

Malware family:

Emotet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/b9bdaa0fdb8a/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.21

Link:

https://yomi.yoroi.company/submissions/b9bdaa0fdb8a01eae676e0276429bbcfa051f9c0ba94abe2229ced6e4b9f6869

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.