MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce7191e22f6c72897763bb9ac3a316ba2052f9ff11d7c4fbb6be40dc81a8f70b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 9


Intelligence 9 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ce7191e22f6c72897763bb9ac3a316ba2052f9ff11d7c4fbb6be40dc81a8f70b
SHA3-384 hash: cf3438887dd3733bbe3c1d94ea878b2ccdc0e43200e44bd2bc544b54cd0c8c39f2916e95d6ffca8504e42bf9bf54db42
SHA1 hash: a135cfe7320dd24151a9c4e79f8f7d576d367348
MD5 hash: b75b3f90436ceb368216ca1ecf70052d
humanhash: lactose-wolfram-mississippi-failed
File name:27660113919839651000.lnk
Download: download sample
Signature Heodo
Create hunting rule
File size:2'418 bytes
First seen:2022-05-02 10:22:21 UTC
Last seen:Never
File type:Shortcut (lnk) lnk
MIME type:application/octet-stream
ssdeep 48:8mM/j/bXjmtwo2SHmRIJCOIIlPDcIwSzN4ab:8mM/DbowoZCOII1t4
TLSH T11841AD2829EA1128F4B3DF7155E86A86DEAAB5A3A912495E00C203064911740EDD1E3E
Reporter TeamDreier
Tags:Emotet Heodo lnk

Intelligence

File Origin
# of uploads :
1
# of downloads :
286
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27118.LnkHeur.UNOFFICIAL
Create hunting rule

MiscreantPunch.INFO.LNK.CMDPSHELL.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD._OUTFILE.220426B64.6.UNOFFICIAL
Create hunting rule

TwinWave.LNKPShellMotherBoardFire.20220428.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.DOCXRSTRGOOD.REGSVR32.220428B64.8.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malicious
File Type:
LNK File - Malicious
Link:
https://app.docguard.net/ce7191e22f6c72897763bb9ac3a316ba2052f9ff11d7c4fbb6be40dc81a8f70b/results/dashboard
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug cmd cmd.exe evasive masquerade packed powershell powershell
Link:
https://www.filescan.io/uploads/626fb11562b1ae4451cbb8bb/reports/2d0e1cfc-cb6f-47c1-8d27-16609ace5f30/overview
Result
Verdict:
MALICIOUS
Details
Base64 Encoded URL
Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ce7191e22f6c72897763bb9ac3a316ba2052f9ff11d7c4fbb6be40dc81a8f70b/
Threat name:
Shortcut.Trojan.BynocoLNK
Create hunting rule
Status:
Malicious
First seen:
2022-05-02 10:23:04 UTC
File Type:
Binary
AV detection:
12 of 42 (28.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zzyzdyrpnrzis53dxonmhiywxiqff6p7chl4j65wxzanzani64fq._file
Result
Malware family:
emotet
Create hunting rule
Score:
  10/10
Tags:
family:emotet botnet:epoch4 banker suricata trojan
Link:
https://tria.ge/reports/220502-meszeahad6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
An obfuscated cmd.exe command-line is typically used to evade detection.
Drops file in System32 directory
Checks computer location settings
Loads dropped DLL
Blocklisted process makes network request
Downloads MZ/PE file
Emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
Malware Config
C2 Extraction:
176.31.73.90:443
45.76.159.214:8080
138.197.147.101:443
104.168.154.79:8080
149.56.131.28:8080
5.9.116.246:8080
77.81.247.144:8080
172.104.251.154:8080
50.30.40.196:8080
173.212.193.249:8080
51.91.76.89:8080
197.242.150.244:8080
103.75.201.2:443
51.254.140.238:7080
79.137.35.198:8080
72.15.201.15:8080
27.54.89.58:8080
189.126.111.200:7080
196.218.30.83:443
82.165.152.127:8080
164.68.99.3:8080
183.111.227.137:8080
167.172.253.162:8080
153.126.146.25:7080
129.232.188.93:443
151.106.112.196:8080
188.44.20.25:443
167.99.115.35:8080
134.122.66.193:8080
185.4.135.165:8080
212.24.98.99:8080
51.91.7.5:8080
146.59.226.45:443
131.100.24.231:80
212.237.17.99:8080
201.94.166.162:443
45.176.232.124:443
159.65.88.10:8080
160.16.142.56:8080
216.158.226.206:443
203.114.109.124:443
103.43.46.182:443
46.55.222.11:443
209.126.98.206:8080
91.207.28.33:8080
1.234.2.232:8080
45.118.115.99:8080
206.189.28.199:8080
94.23.45.86:4143
158.69.222.101:443
103.70.28.102:8080
101.50.0.91:8080
58.227.42.236:80
119.193.124.41:7080
107.182.225.142:8080
185.157.82.211:8080
45.235.8.30:8080
103.132.242.26:8080
1.234.21.73:7080
110.232.117.186:8080
209.97.163.214:443
185.8.212.130:7080
209.250.246.206:443
Malware family:
Emotet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ce7191e22f6c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ce7191e22f6c72897763bb9ac3a316ba2052f9ff11d7c4fbb6be40dc81a8f70b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win64_emotet_unpacked
Create hunting rule
Rule name:Execution_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies execution artefacts in shortcut (LNK) files.
Rule name:EXE_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies executable artefacts in shortcut (LNK) files.
Rule name:PS_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies PowerShell artefacts in shortcut (LNK) files.
Rule name:SUSP_LNK_CMD
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the reference to cmd.exe inside an lnk file, which is suspicious
Rule name:SUSP_PowerShell_Caret_Obfuscation_2
Create hunting rule
Author:Florian Roth
Description:Detects powershell keyword obfuscated with carets
Reference:Internal Research
Rule name:SUSP_PowerShell_Caret_Obfuscation_2_RID347B
Create hunting rule
Author:Florian Roth
Description:Detects powershell keyword obfuscated with carets
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Heodo

Shortcut (lnk) lnk ce7191e22f6c72897763bb9ac3a316ba2052f9ff11d7c4fbb6be40dc81a8f70b

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments