MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bff93708db43d3d6449a7c41c9f193fd28333d1f06d7caa3f7af0442a6b531c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bff93708db43d3d6449a7c41c9f193fd28333d1f06d7caa3f7af0442a6b531c6
SHA3-384 hash: 6f4a1be2879ab1f7bf57a651aba27d40f614d8ba9f7fbe0513eb4d0f96ca4b1c5a8014daa9e3b24c60fe5732a9e6454c
SHA1 hash: b4c0fbeb2dafa99d68d08bab07fbe992654d85e1
MD5 hash: eea9730c8b427009251cf310bd8c99ef
humanhash: two-quebec-maine-wyoming
File name:emotet_exe_e1_bff93708db43d3d6449a7c41c9f193fd28333d1f06d7caa3f7af0442a6b531c6_2020-12-21__141522.exe
Download: download sample
Signature Heodo
Create hunting rule
File size:230'912 bytes
First seen:2020-12-21 14:15:26 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash ae43e9a1247161c13d73d3b87f58b510 (11 x Heodo)
ssdeep 3072:jPaGkyeuX0zkI5DAp8cpJdF3EtRrOnAOaaldw92WLEChd9T4LFIs1:j1kyerNAp9XdpypLhaQ92YEChd9MJ
Threatray 42 similar samples on MalwareBazaar
TLSH F3348C11A2008471F31D0B305846F6E04A5D5E7C26E4E18FFA7D7E7AAD32293AA7725F
Reporter Cryptolaemus1
Tags:Emotet epoch1 exe Heodo


Avatar
Cryptolaemus1
Emotet epoch1 exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
127
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.dc.3834.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bff93708db43d3d6449a7c41c9f193fd28333d1f06d7caa3f7af0442a6b531c6/
Threat name:
Win32.Trojan.EmotetCrypt
Create hunting rule
Status:
Malicious
First seen:
2020-12-21 14:16:07 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
25d23fbf66df863c9be8595beb7ec421ba679123fbfe1d26e664d534c8c68081
Heodo
43a81e80cbd931329625e031d6c04620d95b637406231bc935bf3921374d81de
Heodo
47b014bad2d24296b2d07b3f69a9ce0b7249d11097fc09044a34755ae7be7810
Heodo
5eadfa4dd6b036fb7cc42f1c023fde4579c2d2ab49e4c84b93f6e207272b07b3
Heodo
6ced0d5b3e6fbe5b294e73fe587fc73cbbaf26a32c1abf92fe5c22c57c8a53f2
Heodo
a9295c68b9e6ad169bc14d79108c45b78d1f57b781874677c19e1d6b627890e2
Heodo
b1c619f847f1fd13623002f9a616f3c2ea9d9ac8d1863ba541757549e64a059b
Heodo
c6f7040194cbed0d34fc343d601fef1fc56c0efd381870519c7ca59f208d66a6
Heodo
d2bed66a02677c5f05becd6cf44cbf5307935dfe923dd80660dc7beee8d0430d
Heodo
e9b5c069a0bb351288d1b3bd1d9894cc07e4287c139474e753b42441b486f6f3
Heodo
+ 32 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/201221-19tp15awdj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Blocklisted process makes network request
Unpacked files
SH256 hash:
bff93708db43d3d6449a7c41c9f193fd28333d1f06d7caa3f7af0442a6b531c6
MD5 hash:
eea9730c8b427009251cf310bd8c99ef
SHA1 hash:
b4c0fbeb2dafa99d68d08bab07fbe992654d85e1
Link:
https://www.unpac.me/results/88cc914a-3deb-4bc9-9bce-64217819ce53/
SH256 hash:
f567e145cf928879c13b51b84c057b82fc5727463bc2c976587fc96a2317efcb
MD5 hash:
db0519d8565a35ad1470150813f67602
SHA1 hash:
f3a612986982ec0e12ff2244139f6c65b413e8b8
Detections:
win_emotet_a2
Create hunting rule
Link:
https://www.unpac.me/results/88cc914a-3deb-4bc9-9bce-64217819ce53/
Parent samples :
6ced0d5b3e6fbe5b294e73fe587fc73cbbaf26a32c1abf92fe5c22c57c8a53f2
1acdc1855adbfd9c84fa7833e2b615feda3a4f37961846c93bac3354c8352d59
a9295c68b9e6ad169bc14d79108c45b78d1f57b781874677c19e1d6b627890e2
25d23fbf66df863c9be8595beb7ec421ba679123fbfe1d26e664d534c8c68081
0d1744fd830ffed23cac8e36d7a3b88c35ce34bc1ebe0c57388030a428f99730
b1c619f847f1fd13623002f9a616f3c2ea9d9ac8d1863ba541757549e64a059b
e9e16900388e0eb5009bfda3e9671afb04b8e3ed914db1bdde385c7eafca0e6d
43a81e80cbd931329625e031d6c04620d95b637406231bc935bf3921374d81de
b6a6bacf336d431977df6f95d1d71f22561314abbbb57867b954fc09cf718f60
d2bed66a02677c5f05becd6cf44cbf5307935dfe923dd80660dc7beee8d0430d
c6f7040194cbed0d34fc343d601fef1fc56c0efd381870519c7ca59f208d66a6
5eadfa4dd6b036fb7cc42f1c023fde4579c2d2ab49e4c84b93f6e207272b07b3
47b014bad2d24296b2d07b3f69a9ce0b7249d11097fc09044a34755ae7be7810
e9b5c069a0bb351288d1b3bd1d9894cc07e4287c139474e753b42441b486f6f3
bff93708db43d3d6449a7c41c9f193fd28333d1f06d7caa3f7af0442a6b531c6
ace5ddc10143a31cc2df2146715a6f06aabce2bc62283d744129cad0df6caf24
0773745b0aa51960e3088ca2d947a03271ea86163bd635ece0bbe6a684832e4d
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Emotet
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bff93708db43d3d6449a7c41c9f193fd28333d1f06d7caa3f7af0442a6b531c6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Heodo

DLL dll bff93708db43d3d6449a7c41c9f193fd28333d1f06d7caa3f7af0442a6b531c6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/935352/
  
Delivery method
Distributed via web download

Comments