MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f29a85a0a8d5c438141903be9402dfea15cc0eb89e356da5b53d31edfabed15e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f29a85a0a8d5c438141903be9402dfea15cc0eb89e356da5b53d31edfabed15e
SHA3-384 hash: d29d48e5ef0c149837dcdd7c8a02cc1a1badd298bb0bf59b5c630509110eebfa3bd8d669b2865234c29eb0e7a9caa867
SHA1 hash: 16152d45519a49733807a43559f92e615c8ef1e8
MD5 hash: 0b550abc587600c9a9d1dd5e23a089f9
humanhash: social-beer-aspen-november
File name:0b550abc587600c9a9d1dd5e23a089f9.exe
Download: download sample
Signature Emotet
Create hunting rule
File size:6'731'632 bytes
First seen:2020-12-08 18:14:44 UTC
Last seen:2020-12-08 20:36:09 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 08c12a4e8a6a5e4388e0bc669ebc661c (1 x Emotet)
ssdeep 196608:CEZwgGtztt2tMDzBiikjt+pzg96Bgmtx7La1:uZ3oKzBUjt+igf7L
Threatray 9 similar samples on MalwareBazaar
TLSH 796633E5B2E119A5E0FED331896F9925D273389103D2856F923433235EB35A3353BE26
Reporter abuse_ch
Tags:Emotet exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
173
Origin country :
n/a
Vendor Threat Intelligence
Detection:
PyInstaller
Create hunting rule
Link:
https://www.capesandbox.com/analysis/107323/
Detection(s):
SecuriteInfo.com.PE_File_pyinstaller.30044.1648.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Sending a UDP request
Creating a file
Creating a process from a recently created file
Deleting a recently created file
Enabling the 'hidden' option for recently created files
Setting a keyboard event handler
Setting a global event handler
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Mimikatz
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/558321
Signature
Antivirus / Scanner detection for submitted sample
Installs a global keyboard hook
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Yara detected Mimikatz
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f29a85a0a8d5c438141903be9402dfea15cc0eb89e356da5b53d31edfabed15e/
Threat name:
Win64.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-12-08 17:49:45 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
emotet
Create hunting rule
Similar samples:
08124c7d2c97ffd108f1b7c9bba86aaeff5a41d16c77fcf11b3a8c9504f93424
Emotet
0f4238a14d0c6dbd53c84513df03d0d3be5f8452aa858e2273788690fe7c59dc
Emotet
2b6160a9720ed2cf3b818dafc81e4f092111d4df2e0db161b994b39a5ceb78f3
Emotet
2c9a56116d34514c98f71a77cd80ab3b32d6523b2d7aa9b89b6e4f5c1cd8a8df
Emotet
434ea880ad59cffded73a776f3a01a75e6afef21fc6dca45b364fd3f0ba54de3
Emotet
4b76ad80e9ce4c503bde0e476a88447426fc38315d440d22926627295e1b0ec6
Emotet
8dc94d486fd546ffbf8f21252aba65efe18432a6cae815e02b8be4ce4449291a
Emotet
95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93
Emotet
fe92444d5cb5bbd5c1b55d90a4eb2aca6a7a6a25f06051160be86c80e35e92f9
Emotet
Result
Malware family:
n/a
Score:
  8/10
Tags:
pyinstaller
Link:
https://tria.ge/reports/201208-lkvqztqfv2/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Detects Pyinstaller
JavaScript code in executable
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
f29a85a0a8d5c438141903be9402dfea15cc0eb89e356da5b53d31edfabed15e
MD5 hash:
0b550abc587600c9a9d1dd5e23a089f9
SHA1 hash:
16152d45519a49733807a43559f92e615c8ef1e8
Link:
https://www.unpac.me/results/e21bb6ca-72c9-456e-b361-f23e18b50daf/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Password Stealer
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/f29a85a0a8d5c438141903be9402dfea15cc0eb89e356da5b53d31edfabed15e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PE_File_pyinstaller
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Description:Detect PE file produced by pyinstaller
Reference:https://isc.sans.edu/diary/21057
Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Emotet

Executable exe f29a85a0a8d5c438141903be9402dfea15cc0eb89e356da5b53d31edfabed15e

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/107323/
  
URLhaus
https://urlhaus.abuse.ch/url/899467/
  
Delivery method
Distributed via web download

Comments