MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6905e23e670b58f3b22912d3bc748f731930b041d5c0b9e946c41952406dc1b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet (aka Heodo)

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments

SHA256 hash:	f6905e23e670b58f3b22912d3bc748f731930b041d5c0b9e946c41952406dc1b
SHA3-384 hash:	a4ea5c5a63c0cad93ef859af04780bf6d8319f464416f420cdd544ba8f3f32f243914653bbf93b0474ce203ec062283c
SHA1 hash:	2e50a0a654fcb5d0a54fec5ab876ec118fd04b0e
MD5 hash:	ca5735d30ffa85b51b3e884270da71ad
humanhash:	quiet-undress-lima-sixteen
File name:	file
Download:	download sample
Signature	Heodo Create hunting rule
File size:	903'168 bytes
First seen:	2022-11-04 14:04:07 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	c8d1998b80cffee902d21a3223b8978f (186 x Heodo, 1 x Emotet)
ssdeep	12288:OY67TI+4RcCD01BkNsNi0MBpIwz0WMWQdshDQVxA3:Opk+4Rj01BkN3tphz0WMTmAK
Threatray	481 similar samples on MalwareBazaar
TLSH	T1FD15BF12B3E403B5E5B7E238CE768A45EAB2BC5A5630E34B03E491557F23761493F326
TrID	48.7% (.EXE) Win64 Executable (generic) (10523/12/4) 23.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 9.3% (.EXE) OS/2 Executable (generic) (2029/13) 9.2% (.EXE) Generic Win/DOS Executable (2002/3) 9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter	jstrosch
Tags:	Emotet exe Heodo

Intelligence

File Origin

# of uploads :

# of downloads :

173

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

file

Verdict:

No threats detected

Analysis date:

2022-11-04 14:09:29 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/bac765ce-b6cb-4673-ac2d-154138a5ea78

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/328520/

Detection(s):

SecuriteInfo.com.Win64.BotX-gen.11588.32681.UNOFFICIAL

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Sending a custom TCP request

Сreating synchronization primitives

Launching a process

Moving of the original file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware shell32.dll

Link:

https://www.filescan.io/uploads/63651c0f3c6c57b4ec40ff61/reports/91c2cb57-c4ee-4cd0-ab08-9b8c637a36ee/overview

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/2ec78ad4-cf53-43e6-acb0-2a174b2c4788

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f6905e23e670b58f3b22912d3bc748f731930b041d5c0b9e946c41952406dc1b/

Threat name:

Win64.Trojan.Injuke

Status:

Malicious

First seen:

2022-11-04 14:04:29 UTC

File Type:

PE+ (Dll)

Extracted files:

AV detection:

8 of 26 (30.77%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=62if4i7goc2y6ozcsewtxr2i64yzgcyedvoaxhuunrazkjag3qnq._file

Verdict:

malicious

Label(s):

emotet

Result

Malware family:

emotet

Score:

10/10

Tags:

family:emotet botnet:epoch4 banker persistence trojan

Link:

https://tria.ge/reports/221104-rdatnahghr/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of WriteProcessMemory

Adds Run key to start application

Emotet

Malware Config

C2 Extraction:

45.235.8.30:8080
94.23.45.86:4143
119.59.103.152:8080
169.60.181.70:8080
164.68.99.3:8080
172.105.226.75:8080
107.170.39.149:8080
206.189.28.199:8080
1.234.2.232:8080
188.44.20.25:443
186.194.240.217:443
103.43.75.120:443
149.28.143.92:443
159.89.202.34:443
209.97.163.214:443
183.111.227.137:8080
129.232.188.93:443
139.59.126.41:443
110.232.117.186:8080
139.59.56.73:8080
103.75.201.2:443
91.207.28.33:8080
164.90.222.65:443
197.242.150.244:8080
212.24.98.99:8080
51.161.73.194:443
115.68.227.76:8080
159.65.88.10:8080
201.94.166.162:443
95.217.221.146:8080
173.212.193.249:8080
82.223.21.224:8080
103.132.242.26:8080
213.239.212.5:443
153.126.146.25:7080
45.176.232.124:443
182.162.143.56:443
169.57.156.166:8080
159.65.140.115:443
163.44.196.120:8080
172.104.251.154:8080
167.172.253.162:8080
91.187.140.35:8080
45.118.115.99:8080
147.139.166.154:8080
72.15.201.15:8080
149.56.131.28:8080
167.172.199.165:8080
101.50.0.91:8080
160.16.142.56:8080
185.4.135.165:8080
104.168.155.143:8080
79.137.35.198:8080
5.135.159.50:443
187.63.160.88:80

Verdict:

Informative

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/3504e5bf-fd04-451b-8b4e-fa0ea204bbc0

Unpacked files

SH256 hash:

f6905e23e670b58f3b22912d3bc748f731930b041d5c0b9e946c41952406dc1b

MD5 hash:

ca5735d30ffa85b51b3e884270da71ad

SHA1 hash:

2e50a0a654fcb5d0a54fec5ab876ec118fd04b0e

Link:

https://www.unpac.me/results/3e71979c-1a5f-4d72-b91c-c66753f11e46/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f6905e23e670b58f3b22912d3bc748f731930b041d5c0b9e946c41952406dc1b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com