MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e5a479f0cfa44a26ea311e15511affdc9d5c3c7474b85155eb484d8a3e87c4f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet (aka Heodo)

Vendor detections: 10

Intelligence 10 IOCs YARA 1 File information Comments 1

SHA256 hash:	e5a479f0cfa44a26ea311e15511affdc9d5c3c7474b85155eb484d8a3e87c4f8
SHA3-384 hash:	cdf5451d5314b06c3f4bcfb17a7f774207540883b2179cf8df63531c1634a113ee4487668dda9bcd3e8d171a0c0013f9
SHA1 hash:	0bdcde29cdea1cd77bec0eceee7cd9977cd77f0e
MD5 hash:	f3fedf569194da24c3665a00fda9774f
humanhash:	south-red-failed-triple
File name:	f3fedf569194da24c3665a00fda9774f
Download:	download sample
Signature	Heodo Create hunting rule
File size:	387'072 bytes
First seen:	2021-12-01 19:07:32 UTC
Last seen:	2021-12-01 20:41:03 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	609402ef170a35cc0e660d7d95ac10ce (74 x Heodo)
ssdeep	6144:zBYrPMTsY8GR3j4fubnY6Zs/Bv6yu6aSTsfA2qL6jpXNcc6CEteuQJPIgtlpZ5L:yhmT4GbnYks/BJvWo2LjpScDEteuOIoZ
Threatray	106 similar samples on MalwareBazaar
TLSH	T19F84F103B5C2E6F6D62F04342456D66A6F3E7910072DCEEB9B940DBB4E767C08534A2B
Reporter	zbetcheckin
Tags:	32 dll Emotet exe Heodo

Intelligence

File Origin

# of uploads :

# of downloads :

172

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Emotet

Link:

https://www.capesandbox.com/analysis/210444/

Detection(s):

SecuriteInfo.com.Variant.Midie.105100.18841.31834.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Launching a process

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

anti-debug greyware monero packed

Link:

https://www.filescan.io/uploads/61a7c818f9d950eb11b5d1a6/reports/431b4a4a-4992-4a94-9164-b980d5597904/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a5d18d46-bed6-47c1-a1f5-5aa2bc57e976

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e5a479f0cfa44a26ea311e15511affdc9d5c3c7474b85155eb484d8a3e87c4f8/

Threat name:

Win32.Trojan.Emotetcrypt

Status:

Malicious

First seen:

2021-12-01 19:08:13 UTC

File Type:

PE (Dll)

AV detection:

23 of 28 (82.14%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=4wsht4gpurfcn2rrdykvcgx73sovypduos4fcvpljbgyupuhyt4a._file

Verdict:

malicious

Label(s):

emotet

Result

Malware family:

emotet

Score:

10/10

Tags:

family:emotet botnet:epoch4 banker suricata trojan

Link:

https://tria.ge/reports/211201-xs8xwsfbck/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Blocklisted process makes network request

Emotet

suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)

suricata: ET MALWARE W32/Emotet CnC Beacon 3

Malware Config

C2 Extraction:

46.55.222.11:443
104.245.52.73:8080
41.76.108.46:8080
103.8.26.103:8080
185.184.25.237:8080
103.8.26.102:8080
203.114.109.124:443
45.118.115.99:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
212.237.17.99:8080
212.237.56.116:7080
216.158.226.206:443
110.232.117.186:8080
158.69.222.101:443
107.182.225.142:8080
176.104.106.96:8080
81.0.236.90:443
50.116.54.215:443
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080

Unpacked files

SH256 hash:

b48ad9d5ded6364ce39bb645772a117e5a7fbcff1142df0f08968b6601e950d5

MD5 hash:

100be311beff558c2a159349716c5296

SHA1 hash:

eeb508d6811750d881ac1c660c8cd066c6db41af

Detections:

win_emotet_a2

win_emotet_auto

Link:

https://www.unpac.me/results/c1f021b5-a556-4314-9002-1b58de0ea662/

SH256 hash:

e5a479f0cfa44a26ea311e15511affdc9d5c3c7474b85155eb484d8a3e87c4f8

MD5 hash:

f3fedf569194da24c3665a00fda9774f

SHA1 hash:

0bdcde29cdea1cd77bec0eceee7cd9977cd77f0e

Link:

https://www.unpac.me/results/c1f021b5-a556-4314-9002-1b58de0ea662/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e5a479f0cfa44a26ea311e15511affdc9d5c3c7474b85155eb484d8a3e87c4f8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Emotet Create hunting rule
Author:	Dhanunjaya
Description:	Yara Rule To Detect Emotet

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Heodo

DLL dll e5a479f0cfa44a26ea311e15511affdc9d5c3c7474b85155eb484d8a3e87c4f8

(this sample)

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/210444/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2021-12-01 19:07:33 UTC

url : hxxp://vendes.marketing/transmigrant/Wplzr/