MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb288e875a45764fba65a388edf255226da3042e212f2df0ba56ed7347176043. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eb288e875a45764fba65a388edf255226da3042e212f2df0ba56ed7347176043
SHA3-384 hash: b47f95daf4e7d162181f2b8cef3908e7efc558c4d1acb7e2228515c9e9c0f2d4ad08b9c89800536e039ff603258f5d48
SHA1 hash: ff03fde7bc2fb4e6a9895df8202d70a22d1b2b2d
MD5 hash: 32a804267bba06f1bb85818e2b7717e5
humanhash: vermont-nineteen-earth-alabama
File name:emotet_e1_eb288e875a45764fba65a388edf255226da3042e212f2df0ba56ed7347176043_2020-09-15__100215._doc
Download: download sample
Signature Heodo
Create hunting rule
File size:158'800 bytes
First seen:2020-09-15 10:04:42 UTC
Last seen:2020-09-15 10:05:09 UTC
File type:Word file docx
MIME type:application/msword
ssdeep 1536:gURA+F6URA+Fhrdi1Ir77zOH98Wj2gpngd+a9dxQIY0y+Wbfw:frfrzOH98ipgFxDH7Afw
TLSH 6FF3950A26D1994EF33A8E3027D9AAED1856DCF45D8D40673284BB147637B40E9F1BF8
Reporter Cryptolaemus1
Tags:doc Emotet epoch1 Heodo


Avatar
Cryptolaemus1
Emotet epoch1 doc

Intelligence

File Origin
# of uploads :
45
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
TwinWave.EvilDoc.AutoExecSeparateWays.20200818.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.VB.Trojan.VBA.Agent.BHH.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.WelcomeBackEmotetThatsWhyTheyCallItWindowPain.2020717.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.EmotetCROCryLittleSister.20200720.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.EmotetARCROClubbedToDeathKurayamino.20200904.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Using the Windows Management Instrumentation requests
Creating a process with a hidden window
DNS request
Creating a file
Creating a process from a recently created file
Moving a file to the Windows subdirectory
Creating a service
Connection attempt
Sending an HTTP POST request
Deleting a recently created file
Possible injection to a system process
Enabling autorun for a service
Launching a process by exploiting the app vulnerability
Sending an HTTP GET request to an infection source
Detection:
emotet
Create hunting rule
Link:
https://mwdb.cert.pl/sample/eb288e875a45764fba65a388edf255226da3042e212f2df0ba56ed7347176043/
Threat name:
Document-Word.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2020-09-15 10:06:07 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5mui5b22iv3e7otfuoeo34svejw2gbboeexs34f2k3wxgryxmbbq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
macro
Link:
https://tria.ge/reports/200915-cq4xankqmj/
Behaviour
Suspicious Office macro
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Emotet
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/eb288e875a45764fba65a388edf255226da3042e212f2df0ba56ed7347176043

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Heodo

Word file docx eb288e875a45764fba65a388edf255226da3042e212f2df0ba56ed7347176043

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/505654/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/505658/
  
URLhaus
https://urlhaus.abuse.ch/url/504603/
  
URLhaus
https://urlhaus.abuse.ch/url/508594/
  
URLhaus
https://urlhaus.abuse.ch/url/508584/
  
URLhaus
https://urlhaus.abuse.ch/url/501282/
  
URLhaus
https://urlhaus.abuse.ch/url/503772/

Comments