MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf8f6c445f34a02756d060c226115745f0646ac9cb36218fb462993c571217e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet (aka Heodo)

Vendor detections: 10

Intelligence 10 IOCs YARA File information Comments

SHA256 hash:	cf8f6c445f34a02756d060c226115745f0646ac9cb36218fb462993c571217e4
SHA3-384 hash:	237b8334a408a714dfa5d9f752a8865bd894e7f433e8c650725852b5016e82ae0b807997eb786f2a0cf11f83f09001ef
SHA1 hash:	629f6ee0cf3fea2226d9a94d573cb76cbbd3dbe9
MD5 hash:	59feacede689a780508eafaa67ab0aeb
humanhash:	mars-alabama-indigo-sierra
File name:	emotet_exe_e5_cf8f6c445f34a02756d060c226115745f0646ac9cb36218fb462993c571217e4_2022-01-25__171329.exe
Download:	download sample
Signature	Heodo Create hunting rule
File size:	610'304 bytes
First seen:	2022-01-25 17:13:40 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	4b3c6568be69655a83355a8193247571 (126 x Heodo)
ssdeep	6144:8B4oWMvCBs0YaUG7qJFzR4Dpw0yHz4MmeOfg54hOSRhnID3FQizX5+IgtidXX5+o:8uLMviuaUsqTd45yHz4Mme/STe5
Threatray	763 similar samples on MalwareBazaar
TLSH	T1B1D49C2233DCC8B9E0AE1D3D290297D523E9AE140B93C58FA640FB9E5D3B2C155F92D5
File icon (PE):
dhash icon	71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT)
Reporter	Cryptolaemus1
Tags:	dll Emotet epoch5 exe Heodo

Cryptolaemus1

Emotet epoch5 exe

Intelligence

File Origin

# of uploads :

# of downloads :

113

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/222654/

Detection(s):

SecuriteInfo.com.Trojan.Emotet.1143.14434.14851.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

DNS request

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

control.exe greyware keylogger shell32.dll update.exe

Link:

https://www.filescan.io/uploads/61f02fe1d73ca9d464884133/reports/c17e0460-f129-4aac-a969-73a192a6ffcc/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Emotet

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/387b3f91-7e18-4e90-b06f-e2aa155c0559

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cf8f6c445f34a02756d060c226115745f0646ac9cb36218fb462993c571217e4/

Threat name:

Win32.Trojan.EmotetCrypt

Status:

Malicious

First seen:

2022-01-25 18:00:48 UTC

AV detection:

28 of 43 (65.12%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=z6hwyrc7gsqcovwqmdbcmekxixygi2wjzm3cdd5umkmtyvysc7sa._file

Verdict:

malicious

Label(s):

emotet

Result

Malware family:

emotet

Score:

10/10

Tags:

family:emotet botnet:epoch5 banker trojan

Link:

https://tria.ge/reports/220125-vrzxgsbgh4/

Behaviour

Suspicious use of WriteProcessMemory

Emotet

Malware Config

C2 Extraction:

185.244.166.137:443
185.168.130.138:443
59.148.253.194:443
78.46.73.125:443
195.77.239.39:8080
104.131.62.48:8080
69.16.218.101:8080
203.153.216.46:443
195.154.146.35:443
190.90.233.66:443
191.252.103.16:80
37.44.244.177:8080
168.197.250.14:80
116.124.128.206:8080
54.37.228.122:443
159.69.237.188:443
85.214.67.203:8080
210.57.209.142:8080
78.47.204.80:443
185.148.168.220:8080
142.4.219.173:8080
85.25.120.45:8080
128.199.192.135:8080
66.42.57.149:443
62.171.178.147:8080
54.38.242.185:443
217.182.143.207:443
185.148.168.15:8080
37.59.209.141:8080
207.148.81.119:8080