MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d54070b0b5a697330cc4da2a712d3f299f4468dca0175b9bc426231ea82ceb6f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d54070b0b5a697330cc4da2a712d3f299f4468dca0175b9bc426231ea82ceb6f
SHA3-384 hash: b893d88eb6a061497a23a86871ee10a032823651ceba33674254442b0b2c1e57c3ad8d7b4862fa1b4f0b08ac9a2ce9df
SHA1 hash: 81a9fb4de8fba8e6a7ac65c5529f31b65fa7ea44
MD5 hash: ac77fc9d016667a46532f20fda0b06b5
humanhash: twelve-king-blue-three
File name:emotet_exe_e4_d54070b0b5a697330cc4da2a712d3f299f4468dca0175b9bc426231ea82ceb6f_2021-12-25__000403.exe
Download: download sample
Signature Heodo
Create hunting rule
File size:540'160 bytes
First seen:2021-12-25 00:04:11 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash b5dc9ad96b513c24df30cb14bee2b2dd (28 x Heodo)
ssdeep 6144:GRQUWntghU/R+WtlgxTGZE7AeZ5V3Mi8oRifx/7/AOkcNlz+jOUTWolWVS/NeCcS:OUtghUkiKiZkAeZ5V3doKQ+iQVsV0/
Threatray 449 similar samples on MalwareBazaar
TLSH T104B4C001F6C1D077C12E0430262ED72A4A3A7D749B2899EB93D49A7F4E706C15E35EAE
Reporter Cryptolaemus1
Tags:dll Emotet epoch4 exe Heodo


Avatar
Cryptolaemus1
Emotet epoch4 exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
146
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/216271/
Detection(s):
SecuriteInfo.com.Variant.Fragtor.51189.16486.3519.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/61c6603dec6c6c14a9f05f38/reports/57fa2950-7d84-4d93-8d35-4b244ec0c1d6/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/cd15d8a7-5f96-4834-a15f-83b6b859c81e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d54070b0b5a697330cc4da2a712d3f299f4468dca0175b9bc426231ea82ceb6f/
Threat name:
Win32.Trojan.Fragtor
Create hunting rule
Status:
Malicious
First seen:
2021-12-25 00:05:17 UTC
File Type:
PE (Dll)
Extracted files:
4
AV detection:
11 of 28 (39.29%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
emotet
Create hunting rule
Similar samples:
1e0eac8f6518dbcd6cd9c52acc913e02a4523b5a74080b8b59f2b65da6efe378
Heodo
4db9aef80d739de7aaa8433d9ecdc83f15e6cdfa9eb5da84beadd9094459449b
Heodo
5083a010eebcbbdec77ae2c8ed79ce145b4a8fe5e8a06b188142ee6d2c38a431
Heodo
525cad864e0ca1450fc2e30caefab55372398cff8f5f3822566022ee0a652345
Heodo
60d1b4d97e79d3e0c06ab1296f552d6fd7999e3c02255d70349954abfd34a524
Heodo
7b9411771c7dd51e84b9be71fb9cbe42ea9da534d8a3c61ba1992b7074995588
Heodo
93b1961778134365674fc33819dd1335abb484359f5dbe896f718bc7795035c8
Heodo
b2bd03106cf484e043b77f2331a503d474a7b75e0f41c3564c8da4cd038a21a5
Heodo
b3cccf978d41845e15b0e8938515bbdc4eba70da648b350a5555d870d820cc4f
Heodo
dd98a9248ff7a0ae6cca80cd556a6aeec7d5e863a5041a2d530202127916b0c5
Heodo
+ 439 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/211225-ac7csseefq/
Behaviour
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
4fefbb26fb89d29a794e23851b041d06f7b965ceade4a8dfb062f35eee74a5cf
MD5 hash:
c1a06a13a1de414cd29119046b31e1b6
SHA1 hash:
9316d13b40dcc3e3d63737b1f316d31d28f7e875
Detections:
win_emotet_a2
Create hunting rule
win_emotet_auto
Create hunting rule
Link:
https://www.unpac.me/results/cd353fd4-0670-4426-88cf-01be45ea9ea4/
SH256 hash:
d54070b0b5a697330cc4da2a712d3f299f4468dca0175b9bc426231ea82ceb6f
MD5 hash:
ac77fc9d016667a46532f20fda0b06b5
SHA1 hash:
81a9fb4de8fba8e6a7ac65c5529f31b65fa7ea44
Link:
https://www.unpac.me/results/cd353fd4-0670-4426-88cf-01be45ea9ea4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d54070b0b5a697330cc4da2a712d3f299f4468dca0175b9bc426231ea82ceb6f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Heodo

DLL dll d54070b0b5a697330cc4da2a712d3f299f4468dca0175b9bc426231ea82ceb6f

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/216271/
  
URLhaus
https://urlhaus.abuse.ch/url/1917293/
  
Delivery method
Distributed via web download

Comments