MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f10052e10c319749ccd6aead272df3e831e4d4224a32ac589e1a577db38e2b70. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet

Vendor detections: 18

Intelligence 18 IOCs YARA 3 File information Comments

SHA256 hash:	f10052e10c319749ccd6aead272df3e831e4d4224a32ac589e1a577db38e2b70
SHA3-384 hash:	5e2355ade7b8673feb0c34c6418ca92734a70050fa6db5e309c7926b35f3edeb4d820f90ab80cf53f979476cd0647070
SHA1 hash:	1f3fba680895890258bacf136afc9db655a53571
MD5 hash:	07a65d20c622c4da0027e6d1069903f3
humanhash:	october-arizona-pip-six
File name:	ExeFile (260).exe
Download:	download sample
Signature	Emotet Create hunting rule
File size:	479'543 bytes
First seen:	2024-08-20 14:11:46 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	5d3cef095f5b8db15ffb3c0071c78063 (1 x Emotet)
ssdeep	6144:IE0ezoT0WbqYeQ52w5SSsy9MFjafSRGDumAjVJ7xn+feugnxO44D0Ecf7y:N0VT0vYH52wPd0jz0q9jX7x+fL2ObDiy
Threatray	83 similar samples on MalwareBazaar
TLSH	T1EAA47D2177F6C03BE2736AB14FC1A6A9F579FEA20B1285A35241270E5E325C1DE3127D
TrID	42.0% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 31.5% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.6% (.EXE) Win64 Executable (generic) (10523/12/4) 5.0% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
dhash icon	f1f0d8f0f478f8f8 (3 x QuasarRAT, 2 x DCRat, 1 x Pony)
Reporter	byMattii1234
Tags:	Emotet

Intelligence

File Origin

# of uploads :

# of downloads :

379

Origin country :

Vendor Threat Intelligence

Malware family:

emotet

ID:

File name:

ExeFile (260).exe

Verdict:

Malicious activity

Analysis date:

2024-08-20 15:29:33 UTC

Tags:

emotet trojan

Link:

https://app.any.run/tasks/d494a2b8-a858-4d05-b4cc-30f73d1c6225

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Win.Packed.Emotet-9890732-0

Win.Packed.Emotet-9890757-0

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66c4a455e7ff3f5a063b9eee

Tags:

Encryption Execution Generic Network Other Static Stealth Emotet

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

crypto emotet epmicrosoft_visual_cc fingerprint iceid keylogger microsoft_visual_cc overlay

Link:

https://www.filescan.io/uploads/66c4a444ff28ddc140a0aaa3/reports/eee9df7e-e1a2-4ae4-9cc9-93c669f5ff5c/overview

Verdict:

Malicious

Labled as:

Trojan.Emotet

Link:

https://www.hybrid-analysis.com/sample/f10052e10c319749ccd6aead272df3e831e4d4224a32ac589e1a577db38e2b70

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Emotet

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/fe557712-6505-4d3c-8644-423879fff927

Result

Threat name:

Emotet

Detection:

malicious

Classification:

bank.troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1496012

Signature

AI detected suspicious sample

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Changes security center settings (notifications, updates, antivirus, firewall)

Detected Emotet e-Banking trojan

Drops executables to the windows directory (C:\Windows) and starts them

Found evasive API chain (may stop execution after checking mutex)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Query firmware table information (likely to detect VMs)

Suricata IDS alerts for network traffic

Uses known network protocols on non-standard ports

Yara detected Emotet

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/f10052e10c319749ccd6aead272df3e831e4d4224a32ac589e1a577db38e2b70

Detection:

emotet

Link:

https://mwdb.cert.pl/sample/f10052e10c319749ccd6aead272df3e831e4d4224a32ac589e1a577db38e2b70/

Threat name:

Win32.Trojan.Emotet

Status:

Malicious

First seen:

2019-12-20 04:07:11 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

33 of 38 (86.84%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6eaffyimggluttgwv2wsolpt5ay6jvbcjizkywe6djlx3m4ofnya._file

Verdict:

malicious

Label(s):

emotet

Result

Malware family:

emotet

Score:

10/10

Tags:

family:emotet botnet:epoch2 banker discovery trojan

Link:

https://tria.ge/reports/240820-rh4mjawdjd/

Behaviour

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in System32 directory

Emotet

Malware Config

C2 Extraction:

24.105.202.216:443
24.94.237.248:80
76.164.99.46:80
108.61.99.179:8080
165.227.156.155:443
159.69.89.130:8080
167.99.105.223:7080
87.230.19.21:8080
91.73.197.90:80
210.6.85.121:80
47.156.70.145:80
197.254.221.174:80
58.171.42.66:8080
66.34.201.20:7080
2.38.99.79:80
95.128.43.213:8080
190.12.119.180:443
67.225.179.64:8080
165.228.24.197:80
121.88.5.176:443
120.151.135.224:80
206.81.10.215:8080
174.81.132.128:80
144.139.247.220:80
206.189.112.148:8080
73.176.241.255:80
120.150.246.241:80
45.33.49.124:443
93.147.141.5:80
101.187.134.207:443
47.149.28.234:80
86.98.156.239:443
1.33.230.137:80
46.105.131.87:80
101.187.247.29:80
110.142.38.16:80
62.138.26.28:8080
37.157.194.134:443
160.16.215.66:8080
81.0.63.86:8080
110.143.57.109:80
70.46.247.81:80
174.77.190.137:8080
5.196.74.210:8080
2.237.76.249:80
80.21.182.46:80
201.251.133.92:443
68.118.26.116:80
85.67.10.190:80
217.160.182.191:8080
1.215.28.101:8080
188.152.7.140:80
2.235.190.23:8080
108.20.69.44:80
186.67.208.78:8080
179.13.185.19:80
103.86.49.11:8080
176.106.183.253:8080
31.31.77.83:443
178.209.71.63:8080
192.241.255.77:8080
5.154.58.24:80
12.176.19.218:80
73.214.99.25:80
59.148.227.190:80
173.12.14.133:8080
64.147.15.138:80
128.65.154.183:443
167.71.10.37:8080
184.167.148.162:80
92.222.216.44:8080
82.27.181.93:80
201.173.217.124:443
62.75.187.192:8080
73.11.153.178:8080
178.237.139.83:8080
61.197.110.214:80
138.122.5.214:8080
104.131.11.150:8080
190.53.135.159:21
91.205.215.66:443
159.65.25.128:8080
219.78.255.48:80
74.105.102.97:8080
178.210.51.222:8080
104.137.176.186:80
87.106.136.232:8080
64.53.242.181:8080
201.184.105.242:443
190.220.19.82:443
173.91.11.142:80
182.176.132.213:8090
71.83.82.123:8080
85.72.180.68:80
66.25.34.20:80
138.59.177.106:443
59.103.164.174:80
50.116.86.205:8080
45.51.40.140:80
200.7.243.108:443
100.14.117.137:80
195.244.215.206:80
149.202.153.252:8080
169.239.182.217:8080
5.88.182.250:80
116.48.142.21:443
186.75.241.230:80
108.191.2.72:80
47.6.15.79:80
218.44.21.114:80
190.189.224.117:443
139.130.241.252:443
78.24.219.147:8080
31.177.54.196:443
24.93.212.32:80
104.236.246.93:8080
108.179.206.219:8080
87.106.139.101:8080
104.131.44.150:8080
209.141.54.221:8080
107.170.24.125:8080
189.209.217.49:80
85.152.174.56:80
176.31.200.130:8080
75.80.148.244:80
190.147.215.53:22
66.209.97.122:8080

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/a3fa375d-e4bd-4c2d-a24e-c55538483746

Unpacked files

SH256 hash:

2a973908ecc15a257ee0193f19cb6667822afa04cf29285b7d68e05a71f7397b

MD5 hash:

f166a3be95a8d4c4edf55f064183217d

SHA1 hash:

a2a388905d55c8f75ac80047e7c40284b26ad25a

Detections:

win_emotet_auto

win_emotet_a2

MALW_emotet

MAL_Emotet_Jan20_1

Win32_Trojan_Emotet

Link:

https://www.unpac.me/results/c6c719b3-3340-4a91-8c88-8721f82a3dc7/

SH256 hash:

f10052e10c319749ccd6aead272df3e831e4d4224a32ac589e1a577db38e2b70

MD5 hash:

07a65d20c622c4da0027e6d1069903f3

SHA1 hash:

1f3fba680895890258bacf136afc9db655a53571

Link:

https://www.unpac.me/results/c6c719b3-3340-4a91-8c88-8721f82a3dc7/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f10052e10c319749ccd6aead272df3e831e4d4224a32ac589e1a577db38e2b70

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	NET Create hunting rule
Author:	malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Emotet

exe f10052e10c319749ccd6aead272df3e831e4d4224a32ac589e1a577db38e2b70

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/272590/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
COM_BASE_API	Can Download & Execute components	ole32.dll::CLSIDFromProgID ole32.dll::CoFreeUnusedLibraries
MULTIMEDIA_API	Can Play Multimedia	WINMM.dll::PlaySoundA
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetVolumeInformationA KERNEL32.dll::GetSystemInfo KERNEL32.dll::GetStartupInfoA KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::SetStdHandle
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileA KERNEL32.dll::GetFileAttributesA KERNEL32.dll::FindFirstFileA
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegCreateKeyA ADVAPI32.dll::RegCreateKeyExA ADVAPI32.dll::RegDeleteKeyA ADVAPI32.dll::RegOpenKeyExA ADVAPI32.dll::RegOpenKeyA ADVAPI32.dll::RegQueryValueExA ADVAPI32.dll::RegQueryValueA
WIN_USER_API	Performs GUI Actions	USER32.dll::AppendMenuA USER32.dll::PeekMessageA USER32.dll::CreateWindowExA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample