MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef246ba750950b98b7b42d1251a6b0846457d2ecf656b495e82baf09911ddafd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet

Vendor detections: 17

Intelligence 17 IOCs YARA 2 File information Comments

SHA256 hash:	ef246ba750950b98b7b42d1251a6b0846457d2ecf656b495e82baf09911ddafd
SHA3-384 hash:	23033c3882d08869c6e7d731d0754e8751bbb3ab869de9eea97c9a9d72d83ee76f5ee909bc9f5872836009a250459659
SHA1 hash:	4611026c4d9b2c5f7288c25a3b9975e1c50da499
MD5 hash:	a858c38f9215194bd736730ba1ccbb49
humanhash:	fruit-zulu-mirror-solar
File name:	ExeFile (124).exe
Download:	download sample
Signature	Emotet Create hunting rule
File size:	442'463 bytes
First seen:	2024-08-20 14:08:41 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f89b20f206db78b696e0ca6319068eb8 (276 x Heodo, 1 x Emotet)
ssdeep	6144:jA6gbu5c8hoIaa5fuXiY1nBK6FPiJDDr1kX4/E9Y:mbOc8zaag1ncW2Df1X/Ei
Threatray	143 similar samples on MalwareBazaar
TLSH	T1DA94BF5373E5C833EEAA10310CF847E9B7B5F8104D75CA8B57943A6ED9312E2863E265
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
dhash icon	a9c1fcb1a3c1c0b2 (2 x Heodo, 1 x LummaStealer, 1 x Emotet)
Reporter	byMattii1234
Tags:	Emotet

Intelligence

File Origin

# of uploads :

# of downloads :

329

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

ExeFile (124).exe

Verdict:

Malicious activity

Analysis date:

2024-08-20 14:29:59 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/d083f75e-0019-4958-ac20-1385f4dbdb9b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Win.Packed.Emotet-9482731-0

Win.Packed.Emotet-9482864-0

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66c4a397e7ff3f5a063b9c86

Tags:

Encryption Execution Generic Infostealer Network Other Static Stealth Trojan Emotet

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

emotet epmicrosoft_visual_cc fingerprint hook keylogger microsoft_visual_cc overlay packed unknown

Link:

https://www.filescan.io/uploads/66c4a38f9498a0e255aff736/reports/76836d17-e686-40ff-8f9d-858b50a7be67/overview

Verdict:

Malicious

Labled as:

Trojan.Emotet

Link:

https://www.hybrid-analysis.com/sample/ef246ba750950b98b7b42d1251a6b0846457d2ecf656b495e82baf09911ddafd

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Emotet

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/bbeb78e6-4de6-416a-8cc3-56811cf902da

Result

Threat name:

Emotet

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1495765

Signature

AI detected suspicious sample

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Changes security center settings (notifications, updates, antivirus, firewall)

Drops executables to the windows directory (C:\Windows) and starts them

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Query firmware table information (likely to detect VMs)

Suricata IDS alerts for network traffic

Yara detected Emotet

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/ef246ba750950b98b7b42d1251a6b0846457d2ecf656b495e82baf09911ddafd

Detection:

emotet

Link:

https://mwdb.cert.pl/sample/ef246ba750950b98b7b42d1251a6b0846457d2ecf656b495e82baf09911ddafd/

Threat name:

Win32.Trojan.Emotet

Status:

Malicious

First seen:

2020-08-24 02:36:47 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

34 of 38 (89.47%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=54sgxj2qsufzrn5ufujfdjvqqrsfpuxm6zlljfpifoxqtei53l6q._file

Verdict:

malicious

Label(s):

emotet

Emotet

0571393a81d187d198ea069cc85a022bc7dc2584fc2cc4481972c8869923b9c9

Emotet

0e8ac5595d3ce1cdfcf83ca2875e43863990a241b5cf3cd56c63189d275e061f

Emotet

2fc33c1e38d90dec7abcc82c0de775e89a679d6de0d307ed415b2226205a0b5d

Emotet

8cc289e7ee5dd3e68a2ebb93ac52bb4cd46c66d497b6ea641fbf3c162f52a61a

Emotet

c5c36b968f915094efc4bcdff3b4082ae8635c00aed6d3db408c4408818888fe

Emotet

d3a343398f93f15e95afef428ee4aa3a2bf3abf6876b4578dc870e30288464a7

Emotet

f2850202879569fefa3cdb7fa2282b32edfa45ea64f35867361836a0d9b70e6e

Emotet

f7588d0697f92c0f716b512f1829556ab67f45e1d4c8b7176af930a86a276717

Emotet

+ 133 additional samples on MalwareBazaar

Result

Malware family:

emotet

Score:

10/10

Tags:

family:emotet botnet:epoch1 banker discovery trojan

Link:

https://tria.ge/reports/240820-rf6dcazcnn/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

System Location Discovery: System Language Discovery

Emotet payload

Emotet

Malware Config

C2 Extraction:

181.30.61.163:443
209.126.6.222:8080
5.153.250.14:8080
188.135.15.49:80
104.131.41.185:8080
178.250.54.208:8080
50.28.51.143:8080
170.81.48.2:80
87.106.46.107:8080
191.99.160.58:80
187.162.248.237:80
89.32.150.160:8080
46.28.111.142:7080
190.190.148.27:8080
190.115.18.139:8080
178.79.163.131:8080
73.213.208.163:80
219.92.8.17:8080
95.9.180.128:80
212.71.237.140:8080
82.196.15.205:8080
111.67.12.221:8080
24.135.198.218:80
202.4.57.96:80
61.92.159.208:8080
80.249.176.206:80
77.90.136.129:8080
81.129.198.57:80
58.171.153.81:80
217.13.106.14:8080
24.148.98.177:80
51.255.165.160:8080
190.6.193.152:8080
149.62.173.247:8080
94.206.45.18:80
137.74.106.111:7080
190.195.129.227:8090
85.109.159.61:443
207.144.103.227:80
91.219.169.180:80
217.199.160.224:7080
104.131.103.37:8080
83.169.21.32:7080
82.163.245.38:80
204.225.249.100:7080
152.169.22.67:80
45.161.242.102:80
65.36.62.20:80
185.94.252.27:443
116.125.120.88:443
190.24.243.186:80
190.147.137.153:443
190.128.173.10:80
192.241.146.84:8080
186.250.52.226:8080
68.183.170.114:8080
45.173.88.33:80
12.162.84.2:8080
185.33.0.233:80
68.183.190.199:8080
73.116.193.136:80
213.60.96.117:80
189.2.177.210:443
186.103.141.250:443
177.73.0.98:443
72.47.248.48:7080
2.47.112.152:80
181.129.96.162:8080
5.196.35.138:7080
185.94.252.12:80
190.163.31.26:80
94.176.234.118:443
70.32.84.74:8080
213.176.36.147:8080
114.109.179.60:80
177.74.228.34:80
186.70.127.199:8090
174.100.27.229:80
45.33.77.42:8080
212.93.117.170:80
219.92.13.25:80
188.2.217.94:80
77.55.211.77:8080
172.104.169.32:8080
85.105.140.135:443
209.236.123.42:8080
70.32.115.157:8080
24.135.1.177:80
82.76.111.249:443
192.241.143.52:8080
51.159.23.217:443
191.182.6.118:80
67.247.242.247:80
177.72.13.80:80

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/43035c20-fd2f-4fcd-8db3-b74a7f18ae90

Unpacked files

SH256 hash:

f0a972c1cd05484545133f300534cc659fd9a3a490a6918ab0d9787e7399fac4

MD5 hash:

fff05a6e25af6fd4fc1bc8409d0b18c3

SHA1 hash:

2b70335ae0585793e5171e5bb2624d9223a8c9c6

Detections:

win_emotet_auto

win_emotet_a2

MALW_emotet

Emotet

Win32_Trojan_Emotet

Link:

https://www.unpac.me/results/4580db01-8ee2-4caf-b8c5-c980dbd07214/

Parent samples :

ef246ba750950b98b7b42d1251a6b0846457d2ecf656b495e82baf09911ddafd
d4a663a38d9d5c285e29e7f9cf78d3bca4e6b1e5d1bbc3be750a2671b90fe56d

SH256 hash:

ef246ba750950b98b7b42d1251a6b0846457d2ecf656b495e82baf09911ddafd

MD5 hash:

a858c38f9215194bd736730ba1ccbb49

SHA1 hash:

4611026c4d9b2c5f7288c25a3b9975e1c50da499

Link:

https://www.unpac.me/results/4580db01-8ee2-4caf-b8c5-c980dbd07214/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ef246ba750950b98b7b42d1251a6b0846457d2ecf656b495e82baf09911ddafd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Emotet

exe ef246ba750950b98b7b42d1251a6b0846457d2ecf656b495e82baf09911ddafd

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/438943/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
SHELL_API	Manipulates System Shell	SHELL32.dll::SHGetFileInfoA
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetVolumeInformationA KERNEL32.dll::GetStartupInfoA KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::SetConsoleCtrlHandler KERNEL32.dll::SetStdHandle
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileA KERNEL32.dll::DeleteFileA KERNEL32.dll::MoveFileA KERNEL32.dll::GetFileAttributesA KERNEL32.dll::FindFirstFileA
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegCreateKeyExA ADVAPI32.dll::RegDeleteKeyA ADVAPI32.dll::RegOpenKeyA ADVAPI32.dll::RegOpenKeyExA ADVAPI32.dll::RegQueryValueExA ADVAPI32.dll::RegSetValueExA
WIN_USER_API	Performs GUI Actions	USER32.dll::AppendMenuA USER32.dll::PeekMessageA USER32.dll::CreateWindowExA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample