MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e54d49afe23edf36200b4e0c73779822ba8717ee88def3d17df1ba47d4822dcc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet (aka Heodo)

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	e54d49afe23edf36200b4e0c73779822ba8717ee88def3d17df1ba47d4822dcc
SHA3-384 hash:	51cc2eb456057fc74a67ae9aeefd92bbc20cb0fc15edf75aedb56660175829a8f7915c83f499c68d52652f0f60c27138
SHA1 hash:	78c6324616258b8267b2945f3351ecf70c10d3d1
MD5 hash:	261fa11eeca2fd7e9ea5b0c80bdb5666
humanhash:	lithium-sweet-pizza-single
File name:	emotet_exe_e1_e54d49afe23edf36200b4e0c73779822ba8717ee88def3d17df1ba47d4822dcc_2020-10-15__155605._exe
Download:	download sample
Signature	Heodo Create hunting rule
File size:	468'480 bytes
First seen:	2020-10-15 15:56:13 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	eba1c75dfc0cd44a30f978930436fe7b (116 x Heodo, 1 x CoinMiner.XMRig)
ssdeep	12288:QCeRhmZzvSDrcmacsitPbD5bZy6dFDHvTzT29cq:dFKXvfumVLP29cq
TLSH	BBA4BF316791C031E16325720AD5B7B5AB7EFC381B3786AF3BA0AF5D4A311A3D41436A
Reporter	Cryptolaemus1
Tags:	Emotet epoch1 exe Heodo

Cryptolaemus1

Emotet epoch1 exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Emotet

Link:

https://www.capesandbox.com/analysis/71479/

Detection(s):

SecuriteInfo.com.Generic.mg.07b6c98f57a041d4.9496.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

Sending an HTTP POST request

Sending a UDP request

Detection:

emotet

Link:

https://mwdb.cert.pl/sample/e54d49afe23edf36200b4e0c73779822ba8717ee88def3d17df1ba47d4822dcc/

Threat name:

Win32.Trojan.Emotet

Status:

Malicious

First seen:

2020-10-15 15:58:39 UTC

AV detection:

26 of 29 (89.66%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=4vgutl7ch3ptmialjyghg54yek5iof7ordpphul56g5epvecfxga._file

Result

Malware family:

emotet

Score:

10/10

Tags:

trojan banker family:emotet

Link:

https://tria.ge/reports/201015-ttev2x82we/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Emotet Payload

Emotet

Malware Config

C2 Extraction:

190.96.15.50:80
192.175.111.214:8080
95.85.33.23:8080
192.232.229.54:7080
200.127.14.97:80
190.188.245.242:80
51.15.7.145:80
138.97.60.140:8080
98.13.75.196:80
213.52.74.198:80
74.58.215.226:80
192.81.38.31:80
191.182.6.118:80
212.71.237.140:8080
209.236.123.42:8080
60.93.23.51:80
178.211.45.66:8080
190.24.243.186:80
62.84.75.50:80
50.121.220.50:80
137.74.106.111:7080
68.183.170.114:8080
70.32.115.157:8080
189.2.177.210:443
177.23.7.151:80
24.232.228.233:80
81.215.230.173:443
51.75.33.127:80
35.143.99.174:80
170.81.48.2:80
177.129.17.170:443
5.196.35.138:7080
51.255.165.160:8080
216.47.196.104:80
185.94.252.12:80
70.169.17.134:80
46.101.58.37:8080
192.241.143.52:8080
219.92.13.25:80
172.104.169.32:8080
152.169.22.67:80
77.238.212.227:80
104.131.41.185:8080
74.135.120.91:80
51.38.124.206:80
186.103.141.250:443
181.30.61.163:443
85.214.26.7:8080
190.190.219.184:80
37.187.161.206:8080
87.106.46.107:8080
12.162.84.2:8080
5.189.178.202:8080
83.169.21.32:7080
185.183.16.47:80
111.67.12.221:8080
68.183.190.199:8080
109.190.35.249:80
128.92.203.42:80
138.97.60.141:7080
1.226.84.243:8080
188.157.101.114:80
45.46.37.97:80
46.43.2.95:8080
70.32.84.74:8080
174.118.202.24:443
213.197.182.158:8080
149.202.72.142:7080
12.163.208.58:80
50.28.51.143:8080
82.76.111.249:443
177.144.130.105:8080
105.209.235.113:8080
94.176.234.118:443
45.33.77.42:8080
202.134.4.210:7080
177.73.0.98:443
181.129.96.162:8080
51.15.7.189:80
217.13.106.14:8080
178.250.54.208:8080
185.94.252.27:443
177.74.228.34:80
188.135.15.49:80
5.89.33.136:80
46.105.114.137:8080
190.115.18.139:8080
64.201.88.132:80
183.176.82.231:80
186.70.127.199:8090
177.144.130.105:443
191.191.23.135:80
201.213.177.139:80

Unpacked files

SH256 hash:

e54d49afe23edf36200b4e0c73779822ba8717ee88def3d17df1ba47d4822dcc

MD5 hash:

261fa11eeca2fd7e9ea5b0c80bdb5666

SHA1 hash:

78c6324616258b8267b2945f3351ecf70c10d3d1

Link:

https://www.unpac.me/results/7bb8ebed-c0f9-4e14-8f73-1aee454e0387/

SH256 hash:

c1380084c825332058ddef59d2d078ee60eeae0ae8248f934f992d30eb8a1d2c

MD5 hash:

9352437a9dc82621e272be5e069fe0c4

SHA1 hash:

340de69c6155d2c681f6111e9374f9f1c18a549d

Detections:

win_emotet_a2

Link:

https://www.unpac.me/results/7bb8ebed-c0f9-4e14-8f73-1aee454e0387/

Parent samples :

c192af24926bbbe8c5b20873b47a4903c5884dabf772bbbcfe71f237f17c5dfa
e634549ffa0aa8fbc563eaa11ff10d23fc0e8275183cb44aa710285a5688d28c
09fc48b75b2b36315c812a426b12d580047e5bba37d881edc97c24c3ca2b6f37
54ac08e30d5b1a09a82fdbdcd52b9c185e94606762510dac2d2851cb2acc5752
4a73de4827301fa3fd2c0c79f571f906da160930655686e6e5fb82b39bd04e38
ad91309993dc050970c13aef1e049b8a2de4be04fd327459c3e0f3213d816c0b
64181f65bddeb8c136571db814fd3f038de5bb032929cd741e8afc033cbd3cf0
8bd0dd44380e3ffb0920b22f917e21ffa1f2a3dd4c55d9ef6f40896f10711486
8286fd1cd7c71247e0bdb1cd3ad09bb87418d73f4588fbb052e94c9ccf06bd58
7d9a2509a06e226be05b25e77c1250be10a76b95dc106d2026bee7c0009a2b7c
e54d49afe23edf36200b4e0c73779822ba8717ee88def3d17df1ba47d4822dcc
bc62f69715b9d9498f4d65e5fa52ae50b488a0d921d37eba57887c6669a6e59d
61893c668c91e4b9c5ed76bbc8d0aad7122c49be147e653f97d6597f6f972d70
b32956f3821ae462f51b59b16070c7a72ad83b90a931bd04b28c8ce55ba56ee5
9896c6d48c71ef89291015b48da4eb0e3d2b92ef2c96b16bbda31d5b91a43039
781de750744e72cedf123d0820eb83bf8a97f3e21e313fa7cbd7373534e441bc
b63978df84d382275fe1724fb815054ceca2e9f58ed101b1ff0524757aca0f3f
86984a36027336b12d502e4654f5d56371095f03c886710aeeb3eb8d7f6f699d
c2b6e860d4ff5c15c16d146748afc39387020c0caf6ae8590644d79f91ac3bc2
791dfbb532f36baa24cd134eba2e6a2b67a396b5754eecd04bb8f2f47151a0d7
2dfeb58c46acf1fb894d2debce72698c426ac56b23d9e9ad8dd8df464d768d80
f3b1c17cff9ac15c06dd6ad27dcbbcd7ae7fb34b5177e72ec381c6787d9edd82
e6276ef1f6aaa4860a3fdb71e4fcaa3aac8fac2c4bdc43e9c9535309ccdc7f4a
32775f9040e44f1724ecfdc86041d197f6934fe9e1bb4951f038b419619ca622
0f20f11004202b6da39e0050ee2c068dda61a25bd02f9c643a7f4c632181d5e4
57b1a0cb1f690f8d5554814bd73c567b2872d37d97d86dc56ec722251218996b
4519dc28b3f4bbc1a919a45e2f3904674a1129204bce61ecafcc6549df1d023a
87e201679921f105e51e83fb527d417f78092f172a6625f490c99c36bf7cf9f8
f4ba29b436c5f6fa2ebcfca597d77517a61e7dbc685f639b1a4842967ca16654

SH256 hash:

517b15aa62c4c9a3a61044b12e9cf7a3b08959521e43eb9f3e5c72294039339a

MD5 hash:

ee5302c6afd73377eecdb76a73a0e2f9

SHA1 hash:

a4219988f9e17d612251b40884d4aca2d4018611

Detections:

win_emotet_a2

Link:

https://www.unpac.me/results/7bb8ebed-c0f9-4e14-8f73-1aee454e0387/

Parent samples :

c192af24926bbbe8c5b20873b47a4903c5884dabf772bbbcfe71f237f17c5dfa
e634549ffa0aa8fbc563eaa11ff10d23fc0e8275183cb44aa710285a5688d28c
09fc48b75b2b36315c812a426b12d580047e5bba37d881edc97c24c3ca2b6f37
54ac08e30d5b1a09a82fdbdcd52b9c185e94606762510dac2d2851cb2acc5752
4a73de4827301fa3fd2c0c79f571f906da160930655686e6e5fb82b39bd04e38
ad91309993dc050970c13aef1e049b8a2de4be04fd327459c3e0f3213d816c0b
64181f65bddeb8c136571db814fd3f038de5bb032929cd741e8afc033cbd3cf0
8bd0dd44380e3ffb0920b22f917e21ffa1f2a3dd4c55d9ef6f40896f10711486
8286fd1cd7c71247e0bdb1cd3ad09bb87418d73f4588fbb052e94c9ccf06bd58
7d9a2509a06e226be05b25e77c1250be10a76b95dc106d2026bee7c0009a2b7c
e54d49afe23edf36200b4e0c73779822ba8717ee88def3d17df1ba47d4822dcc
bc62f69715b9d9498f4d65e5fa52ae50b488a0d921d37eba57887c6669a6e59d
61893c668c91e4b9c5ed76bbc8d0aad7122c49be147e653f97d6597f6f972d70
b32956f3821ae462f51b59b16070c7a72ad83b90a931bd04b28c8ce55ba56ee5
9896c6d48c71ef89291015b48da4eb0e3d2b92ef2c96b16bbda31d5b91a43039
781de750744e72cedf123d0820eb83bf8a97f3e21e313fa7cbd7373534e441bc
b63978df84d382275fe1724fb815054ceca2e9f58ed101b1ff0524757aca0f3f
86984a36027336b12d502e4654f5d56371095f03c886710aeeb3eb8d7f6f699d
ec2c142da4d44e392930a9c12dd30c3fcdd4101a316eaa4f160719458c8c6bfa
352ead87a2dafddf81c27a758a68aca06b3682e98bcf8ccff37e3bd1bbef439c
f44731a1a19fc4e975e42d69328073dfb5b195911f2c9a35802cdd209e9b6328
74b4565590ed5e9d17baa980252b6d9f1df02235608674bf9d15405c7711fea4
da8ddd6b1ce3de30bb2b3d482a661c86797bff9d291d7829c50869760f824ea2
c111944f3a64c333884b6c4087ee35c177a5bd95ea3ccb69f712450273600c6b
c2b6e860d4ff5c15c16d146748afc39387020c0caf6ae8590644d79f91ac3bc2
791dfbb532f36baa24cd134eba2e6a2b67a396b5754eecd04bb8f2f47151a0d7
2dfeb58c46acf1fb894d2debce72698c426ac56b23d9e9ad8dd8df464d768d80
f3b1c17cff9ac15c06dd6ad27dcbbcd7ae7fb34b5177e72ec381c6787d9edd82
e6276ef1f6aaa4860a3fdb71e4fcaa3aac8fac2c4bdc43e9c9535309ccdc7f4a
32775f9040e44f1724ecfdc86041d197f6934fe9e1bb4951f038b419619ca622
0f20f11004202b6da39e0050ee2c068dda61a25bd02f9c643a7f4c632181d5e4
57b1a0cb1f690f8d5554814bd73c567b2872d37d97d86dc56ec722251218996b
24b6b838e17e88c84c8f121fba2a1372ab1b59d65bc21aecc03984833074393f
4519dc28b3f4bbc1a919a45e2f3904674a1129204bce61ecafcc6549df1d023a
87e201679921f105e51e83fb527d417f78092f172a6625f490c99c36bf7cf9f8
f4ba29b436c5f6fa2ebcfca597d77517a61e7dbc685f639b1a4842967ca16654

SH256 hash:

4b90ef49180d2ae9294e8340d620abc698313f4d28b16d3765e7b2ddc1a82109

MD5 hash:

e0943319d7bdc576e163783575936373

SHA1 hash:

fd5ca7f9bb571e4b862c2a92a9b3df15167e82c8

Link:

https://www.unpac.me/results/7bb8ebed-c0f9-4e14-8f73-1aee454e0387/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Emotet

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e54d49afe23edf36200b4e0c73779822ba8717ee88def3d17df1ba47d4822dcc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Cobalt_functions Create hunting rule
Author:	@j0sm1
Description:	Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

Rule name:	Win32_Trojan_Emotet Create hunting rule
Author:	ReversingLabs
Description:	Yara rule that detects Emotet trojan.

Rule name:	win_sisfader_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator