🀲🏼 NEW | abuse.ch Community Hub! Earn recognition πŸ… for the malware intelligence you share, climb the leaderboards πŸ“ˆ, and connect with like-minded contributors who share your hunting focus 🀝. Ready to unlock your profile? Go to the Community Hub β†’

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d1921b648c42486709b70b6fa8dab237faef47719940b4bbfae81e446540bc11. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 10


Intelligence 10 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d1921b648c42486709b70b6fa8dab237faef47719940b4bbfae81e446540bc11
SHA3-384 hash: 393fd2c09169f97fa4e5416a75d5d28305c68e17f7fa985f5820c49f54f2f5982d6e223f2b157a11c7ef2d2a4856a988
SHA1 hash: 7bef2111d84ffba74c3b2d48dd098dc01b399d20
MD5 hash: 41842f3ea7a063a3e0b2c0191b3fa028
humanhash: texas-crazy-william-saturn
File name:41842f3ea7a063a3e0b2c0191b3fa028.zip
Download: download sample
Signature Heodo
Create hunting rule
File size:1'616'579 bytes
First seen:2026-10-12 12:25:28 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:EefdlZQNA005nkd9omDi+PcuhVnV4gipAFHllfveZsJPklJe/DjKNniO0S:hQB05upj0ujBBLJLJR/Dj+F
TLSH T1177533FE84F52FAD948A6543437C1EBD992F4CC121912E66C35ADA44EA3E718E3C2D4C
Magika zip
Reporter smica83
Tags:zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
153
Origin country :
HU HU
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:每ζ—₯δΈšη»©ζ±‡ζŠ₯.exe
File size:2'134'110 bytes
SHA256 hash: 1e4bed20472e3ace6589d18597867c0736d5b2b12abfad7abe9cbe1b84a6bcbb
MD5 hash: 1a7782b7d6dbf302f77852a3f388e86f
MIME type:application/x-dosexec
Signature Heodo
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/ac59de04-e150-43de-8667-e46a10fcc424/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad0fa2f6f551121ba161934
Tags:
cobalt delphi
Result
Verdict:
Malicious
File Type:
PE File
Link:
https://app.docguard.net/d1921b648c42486709b70b6fa8dab237faef47719940b4bbfae81e446540bc11/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/d1921b648c42486709b70b6fa8dab237faef47719940b4bbfae81e446540bc11
Verdict:
Malicious
File Type:
zip
First seen:
2026-10-12T11:43:00Z UTC
Last seen:
2026-10-12T12:00:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/d1921b648c42486709b70b6fa8dab237faef47719940b4bbfae81e446540bc11/results?tab=lookup
Score:
86%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/d1921b648c42486709b70b6fa8dab237faef47719940b4bbfae81e446540bc11
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Zip Archive
Link:
https://app.malva.re/file/41842f3ea7a063a3e0b2c0191b3fa028
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d1921b648c42486709b70b6fa8dab237faef47719940b4bbfae81e446540bc11/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-10-12 11:26:50 UTC
File Type:
Binary (Archive)
Extracted files:
25
AV detection:
14 of 23 (60.87%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2gjbwzemijegocnxbnx2rwvsg75o6r3rtfaljo725apeizkaxqiq._file
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:danabot banker defense_evasion discovery execution installer trojan
Link:
https://tria.ge/reports/261012-ptlvraet8p/
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Inno Setup is an open-source installation builder for Windows applications.
Program crash
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Enumerates video capture drivers
Executes a VBScript file via the Windows Script Host.
Executes dropped EXE
Loads dropped DLL
Downloads MZ/PE file
Family: Danabot
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d1921b648c42486709b70b6fa8dab237faef47719940b4bbfae81e446540bc11

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:MULTI_Malware_AgentTesla_ForgeAuto_ed343f78_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects AgentTesla (inconnu, etat extrait)
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:WIN_Malware_Unknown_ForgeAuto_1708427c_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_4ab123d7_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_6422f546_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_f5d58a9e_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments