MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cefc29d1c8050716f723300175d33b133a5787c9e0d6b4fb2c5b4ba382f32a39. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet (aka Heodo)

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	cefc29d1c8050716f723300175d33b133a5787c9e0d6b4fb2c5b4ba382f32a39
SHA3-384 hash:	0d33256854c9be617dac501cf8bfd8d949d7ad28b568363fc80f51dafa6c86f3e856f46fb9a11416a7aeeed470200bb9
SHA1 hash:	2f56a56b32f2351081a2b4c12a1571a93c67dd02
MD5 hash:	4227dd3e5d56ac8d84b22254dd488cd3
humanhash:	black-johnny-harry-yellow
File name:	emotet_exe_e2_cefc29d1c8050716f723300175d33b133a5787c9e0d6b4fb2c5b4ba382f32a39_2020-10-21__101331._exe
Download:	download sample
Signature	Heodo Create hunting rule
File size:	733'184 bytes
First seen:	2020-10-21 10:13:41 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ddff8be21239488981a9a0b131e6cc96 (48 x Heodo)
ssdeep	3072:3WuNy7PvgvkuE318K343DtMrNUcWiAWuNy7PvgvkuPACG363bDdToIXtGgpevAfu:3JNePBuEzh3sJNePBuXToYZHPs
TLSH	1DF4EB17AA941AC2E066A578CD6F0ECC8415BC9BADB8864F13D1FE2F0CF0741786775A
Reporter	Cryptolaemus1
Tags:	Emotet epoch2 exe Heodo

Cryptolaemus1

Emotet epoch2 exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Emotet

Link:

https://www.capesandbox.com/analysis/74027/

Detection(s):

Win.Malware.Generic-9781033-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Connection attempt

Sending an HTTP POST request

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cefc29d1c8050716f723300175d33b133a5787c9e0d6b4fb2c5b4ba382f32a39/

Threat name:

Win32.Trojan.Emotet

Status:

Malicious

First seen:

2020-10-21 10:15:25 UTC

AV detection:

26 of 29 (89.66%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=z36ctuoiaudrn5zdgaaxluz3cm5fpb6j4dllj6zmlnf2haxtfi4q._file

Result

Malware family:

emotet

Score:

10/10

Tags:

trojan banker family:emotet

Link:

https://tria.ge/reports/201021-mfylqqrdlx/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Emotet Payload

Emotet

Malware Config

C2 Extraction:

115.94.207.99:443
5.196.108.185:8080
167.114.153.111:8080
87.106.136.232:8080
62.30.7.67:443
108.46.29.236:80
24.179.13.119:80
89.121.205.18:80
46.105.131.79:8080
173.63.222.65:80
174.45.13.118:80
216.139.123.119:80
172.91.208.86:80
155.186.9.160:80
96.245.227.43:80
102.182.93.220:80
24.230.141.169:80
104.131.123.136:443
104.131.11.150:443
203.153.216.189:7080
37.139.21.175:8080
94.230.70.6:80
194.187.133.160:443
50.91.114.38:80
118.83.154.64:443
78.24.219.147:8080
97.82.79.83:80
95.9.5.93:80
24.137.76.62:80
190.29.166.0:80
50.35.17.13:80
139.162.108.71:8080
50.245.107.73:443
98.174.164.72:80
49.3.224.99:8080
190.108.228.27:443
209.141.54.221:7080
61.19.246.238:443
76.175.162.101:80
5.39.91.110:7080
87.106.139.101:8080
72.143.73.234:443
110.142.236.207:80
190.240.194.77:443
74.208.45.104:8080
113.61.66.94:80
103.86.49.11:8080
181.126.74.180:80
121.7.31.214:80
209.54.13.14:80
153.164.70.236:80
186.70.56.94:443
186.74.215.34:80
91.211.88.52:7080
47.144.21.12:443
202.141.243.254:443
68.252.26.78:80
71.15.245.148:8080
188.219.31.12:80
104.131.44.150:8080
174.106.122.139:80
49.50.209.131:80
66.76.12.94:8080
123.176.25.234:80
123.142.37.166:80
218.147.193.146:80
91.146.156.228:80
139.99.158.11:443
69.206.132.149:80
120.150.60.189:80
85.105.111.166:80
94.200.114.161:80
185.94.252.104:443
89.216.122.92:80
62.75.141.82:80
208.180.207.205:80
162.241.140.129:8080
109.74.5.95:8080
75.139.38.211:80
95.213.236.64:8080
220.245.198.194:80
139.59.60.244:8080
130.0.132.242:80
78.188.106.53:443
71.72.196.159:80
110.145.77.103:80
83.110.223.58:443
139.162.60.124:8080
176.111.60.55:8080
94.23.237.171:443
37.187.72.193:8080
47.36.140.164:80
124.41.215.226:80
121.124.124.40:7080
120.150.218.241:443
61.33.119.226:443
137.59.187.107:8080
157.245.99.39:8080
75.143.247.51:80
172.104.97.173:8080
184.180.181.202:80
75.188.96.231:80
79.137.83.50:443
142.112.10.95:20
76.171.227.238:80
162.241.242.173:8080
168.235.67.138:7080
93.147.212.206:80
74.214.230.200:80
194.4.58.192:7080
80.241.255.202:8080

Unpacked files

SH256 hash:

b6f53aff0dffed4bb919cf7cd6d5dc6ed473ddf566a41176aa9a44ab4f7d979e

MD5 hash:

d59742fb8fae100e4660ce2102bdce40

SHA1 hash:

54a8fea69b96bfe859288345e99a4f31dc881298

Detections:

win_emotet_a2

win_emotet_auto

Link:

https://www.unpac.me/results/9ad34251-74e3-4774-b58f-29b8c8a2c23f/

Parent samples :

c77e12c582e1fa95272debdbde53eee509d1f57a5d6693f5308eb1a22d8a4367
e5c9a90381918e58f08d407bd540d2c43040eb0077efebd27ab92fd53010e0a5
cefc29d1c8050716f723300175d33b133a5787c9e0d6b4fb2c5b4ba382f32a39
4faf0330a092329562d8d79c71cb143e22af30b106a24d1ce37721f2af9d6598
778d45839f12ace0bf98664c167ac7d83c09e1ae3dcbec3e5ba112492605f4bd
c2b1a8eccfcc0af7d0a983612ce7b0b567cb49db36686c57985dadb6c4aa88fe
7b1f41c2637cb64002e085187d4c5fdecea9153e28207ebab8984473771919f9
5d6af7d54dd07c896dd19960ec3b5c2f54061c2777b9c382fef8ca0ff2abad2a
ec4e643da5bd911866dd6112e41b8c073c5b27f5599fe9baa8aebd1a4d3bae93
4c701955194d939dacbe45b122a07631dcc5d74a7a2a7cad3e2bab4b2297dbbe
4809679d5a8f335cea1bfd3c4a729c24a02099c1c9c13136e7c9cf7c8b7a7242

SH256 hash:

cefc29d1c8050716f723300175d33b133a5787c9e0d6b4fb2c5b4ba382f32a39

MD5 hash:

4227dd3e5d56ac8d84b22254dd488cd3

SHA1 hash:

2f56a56b32f2351081a2b4c12a1571a93c67dd02

Link:

https://www.unpac.me/results/9ad34251-74e3-4774-b58f-29b8c8a2c23f/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Win32_Trojan_Emotet Create hunting rule
Author:	ReversingLabs
Description:	Yara rule that detects Emotet trojan.

Rule name:	win_emotet_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator