MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e00a90c730586d2ab8b84a91f7e7697cd3652351a36c52b6b7e8a84a3287368c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet (aka Heodo)

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments

SHA256 hash:	e00a90c730586d2ab8b84a91f7e7697cd3652351a36c52b6b7e8a84a3287368c
SHA3-384 hash:	25477a743a8bf55e2177f235039bfe2e94bce424774e169bd51c2616babb8d3bf81260054a2ae5083c8f26a4cfb8888c
SHA1 hash:	8560176afe49524fc36b6a2a301b46af21987e5e
MD5 hash:	842e3c79e0841f109ba900198acc3a60
humanhash:	montana-thirteen-violet-potato
File name:	file
Download:	download sample
Signature	Heodo Create hunting rule
File size:	903'168 bytes
First seen:	2022-11-04 14:02:10 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	c8d1998b80cffee902d21a3223b8978f (186 x Heodo, 1 x Emotet)
ssdeep	12288:OY67TI+4RcCD01BkNsNi0MBpIwz0WMWQdshDQgxA3:Opk+4Rj01BkN3tphz0WMTm1K
Threatray	471 similar samples on MalwareBazaar
TLSH	T1F115BF12B3E403B5E5B7E238CE768A45EAB2BC5A5630E34B03E491557F23761493F326
TrID	48.7% (.EXE) Win64 Executable (generic) (10523/12/4) 23.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 9.3% (.EXE) OS/2 Executable (generic) (2029/13) 9.2% (.EXE) Generic Win/DOS Executable (2002/3) 9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter	jstrosch
Tags:	Emotet exe Heodo

Intelligence

File Origin

# of uploads :

# of downloads :

180

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

file

Verdict:

No threats detected

Analysis date:

2022-11-04 14:07:39 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/9c1b5259-0390-48f6-956b-1525484aa58b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/328511/

Detection(s):

SecuriteInfo.com.Win64.BotX-gen.11588.32681.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Launching a process

Sending a custom TCP request

Forced system process termination

Creating a window

Moving of the original file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware shell32.dll

Link:

https://www.filescan.io/uploads/63651b9715611f8d8bf8d60e/reports/a2f73370-5604-499e-82f7-741d743f8f3f/overview

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/dc12dda2-7e24-4931-9de8-df6b2b3c0d10

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e00a90c730586d2ab8b84a91f7e7697cd3652351a36c52b6b7e8a84a3287368c/

Threat name:

Win64.Trojan.Injuke

Status:

Malicious

First seen:

2022-11-04 14:03:07 UTC

File Type:

PE+ (Dll)

Extracted files:

AV detection:

13 of 26 (50.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4afjbrzqlbwsvofyjki7pz3jptjwki2runwffnvx5cueumuhg2ga._file

Verdict:

malicious

Label(s):

emotet

Result

Malware family:

emotet

Score:

10/10

Tags:

family:emotet botnet:epoch4 banker persistence trojan

Link:

https://tria.ge/reports/221104-rcpw7afgh7/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of WriteProcessMemory

Adds Run key to start application

Emotet

Malware Config

C2 Extraction:

45.235.8.30:8080
94.23.45.86:4143
119.59.103.152:8080
169.60.181.70:8080
164.68.99.3:8080
172.105.226.75:8080
107.170.39.149:8080
206.189.28.199:8080
1.234.2.232:8080
188.44.20.25:443
186.194.240.217:443
103.43.75.120:443
149.28.143.92:443
159.89.202.34:443
209.97.163.214:443
183.111.227.137:8080
129.232.188.93:443
139.59.126.41:443
110.232.117.186:8080
139.59.56.73:8080
103.75.201.2:443
91.207.28.33:8080
164.90.222.65:443
197.242.150.244:8080
212.24.98.99:8080
51.161.73.194:443
115.68.227.76:8080
159.65.88.10:8080
201.94.166.162:443
95.217.221.146:8080
173.212.193.249:8080
82.223.21.224:8080
103.132.242.26:8080
213.239.212.5:443
153.126.146.25:7080
45.176.232.124:443
182.162.143.56:443
169.57.156.166:8080
159.65.140.115:443
163.44.196.120:8080
172.104.251.154:8080
167.172.253.162:8080
91.187.140.35:8080
45.118.115.99:8080
147.139.166.154:8080
72.15.201.15:8080
149.56.131.28:8080
167.172.199.165:8080
101.50.0.91:8080
160.16.142.56:8080
185.4.135.165:8080
104.168.155.143:8080
79.137.35.198:8080
5.135.159.50:443
187.63.160.88:80

Verdict:

Informative

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/759fc540-8689-457d-b92f-f76cf87dd234

Unpacked files

SH256 hash:

e00a90c730586d2ab8b84a91f7e7697cd3652351a36c52b6b7e8a84a3287368c

MD5 hash:

842e3c79e0841f109ba900198acc3a60

SHA1 hash:

8560176afe49524fc36b6a2a301b46af21987e5e

Link:

https://www.unpac.me/results/4ebbc104-8eb2-495f-8acd-e9e7ccff343a/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e00a90c730586d2ab8b84a91f7e7697cd3652351a36c52b6b7e8a84a3287368c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com