MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ecf44195be78e323e8c187ff468e5d1864369d5aa56b9adcab6ace77c4ead23c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet (aka Heodo)

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	ecf44195be78e323e8c187ff468e5d1864369d5aa56b9adcab6ace77c4ead23c
SHA3-384 hash:	3287633d1e099689193328f1fcc684a46b694f2277e91e0e9d587da5200d997b21faa911c004398416ea1a1d5f4ce8d5
SHA1 hash:	ba6c528e88d418d7fa59c6797278f7fe2e393661
MD5 hash:	cf67c97731b1909803683d1056b547ac
humanhash:	skylark-tennis-butter-red
File name:	g3rHa.exe
Download:	download sample
Signature	Heodo Create hunting rule
File size:	643'178 bytes
First seen:	2020-07-22 07:43:21 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	cc8e14cc73aaa83c68c2cab2e4569a4a (18 x Heodo)
ssdeep	6144:25FdA9+3bkRQIwYEgRy2k46fifql0B1V8fLzaWS63nxyhXU:2vdA9SGh9rBylaeatknxn
Threatray	29 similar samples on MalwareBazaar
TLSH	49D4B35329698406C4690431ECEF5EFC5AA4AC639F2448D327A4FF5DADF23C4B437269
Reporter	JAMESWT_WT
Tags:	Emotet Heodo

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Emotet

Link:

https://www.capesandbox.com/analysis/30890/

Detection(s):

SecuriteInfo.com.Trojan.DownLoader34.2817.18889.14561.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Result

Threat name:

Emotet

Detection:

malicious

Classification:

troj.evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/394618

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ecf44195be78e323e8c187ff468e5d1864369d5aa56b9adcab6ace77c4ead23c/

Threat name:

Win32.Trojan.Emotet

Status:

Malicious

First seen:

2020-07-22 07:45:06 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=5t2edfn6pdrsh2gbq77unds5dbsdnhk2uvvzvxflnlhhprhk2i6a._file

Result

Malware family:

emotet

Score:

10/10

Tags:

trojan banker family:emotet

Link:

https://tria.ge/reports/200722-xm67sr4s56/

Behaviour

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Emotet

Malware Config

C2 Extraction:

94.49.254.194:80
212.51.142.238:8080
91.231.166.124:8080
162.241.92.219:8080
79.98.24.39:8080
109.117.53.230:443
78.189.165.52:8080
113.160.130.116:8443
121.124.124.40:7080
101.187.97.173:80
168.235.67.138:7080
104.131.44.150:8080
5.39.91.110:7080
139.59.60.244:8080
81.2.235.111:8080
116.203.32.252:8080
61.19.246.238:443
176.111.60.55:8080
190.55.181.54:443
108.48.41.69:80
203.153.216.189:7080
103.86.49.11:8080
104.236.246.93:8080
75.139.38.211:80
169.239.182.217:8080
62.75.141.82:80
93.156.165.186:80
73.11.153.178:8080
157.245.99.39:8080
41.60.200.34:80
50.116.86.205:8080
31.31.77.83:443
209.182.216.177:443
62.138.26.28:8080
95.213.236.64:8080
95.179.229.244:8080
209.141.54.221:8080
91.211.88.52:7080
173.91.22.41:80
222.214.218.37:4143
37.187.72.193:8080
137.59.187.107:8080
139.130.242.43:80
46.105.131.87:80
87.106.139.101:8080
200.55.243.138:8080
5.196.74.210:8080
79.7.158.208:80
185.94.252.104:443
104.131.11.150:443
37.139.21.175:8080
190.108.228.62:443
24.1.189.87:8080
91.205.215.66:443
186.208.123.210:443
108.26.231.214:80
201.173.217.124:443
110.145.77.103:80
190.160.53.126:80
162.154.38.103:80
78.24.219.147:8080
210.165.156.91:80
109.74.5.95:8080
95.9.185.228:443
93.51.50.171:8080
200.41.121.90:80
46.105.131.79:8080
124.45.106.173:443
74.208.45.104:8080
153.126.210.205:7080
87.106.136.232:8080
190.144.18.198:80

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Unknown

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ecf44195be78e323e8c187ff468e5d1864369d5aa56b9adcab6ace77c4ead23c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Cobalt_functions Create hunting rule
Author:	@j0sm1
Description:	Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT