MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb32b75843442aef11caec3b9d988811b47aba63557dbf8508f31d75d8fb49ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet (aka Heodo)

Vendor detections: 10

Intelligence 10 IOCs YARA File information Comments

SHA256 hash:	fb32b75843442aef11caec3b9d988811b47aba63557dbf8508f31d75d8fb49ab
SHA3-384 hash:	20656e8dadba2894e8e39f8beeb5a54cd4c13b25fdd2451552b2cf73565aba6641006d2593db699d7d603f910e373e06
SHA1 hash:	6adb9cbc404ad4a46098e52099c4e45757c04f49
MD5 hash:	ee6342cef7290b4484a476a5349ab2bb
humanhash:	two-mockingbird-angel-gee
File name:	fb32b75843442aef11caec3b9d988811b47aba63557dbf8508f31d75d8fb49ab
Download:	download sample
Signature	Heodo Create hunting rule
File size:	258'560 bytes
First seen:	2021-11-16 11:11:46 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	c50e47fa2c7197441952918ce6851ec0 (118 x Heodo)
ssdeep	3072:PtgItJoMl9eJ02kGuBDhk3VsbwVBQdP6ZkiaoZa74jZUUzdDIm6O80MTcdfokHJf:OHK9eSBFA+bwVB35tMTc5ocEFWTBDz
Threatray	37 similar samples on MalwareBazaar
TLSH	T1FB44BF00B280A072D9FF193A45E5C6694ABC7A500F90D9CF639858BE5F775C2B6309EF
Reporter	fr0s7_
Tags:	dll Emotet Heodo

fr0s7_

Emotet DLL

Intelligence

File Origin

# of uploads :

# of downloads :

119

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Emotet

Link:

https://www.capesandbox.com/analysis/206348/

Detection(s):

Win.Malware.Generic-9909860-0

SecuriteInfo.com.W32.AIDetect.malware2.11831.11772.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Launching a process

Sending a UDP request

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/619392142695a62af9f13828/reports/6f039a38-d0c6-4d1a-a1d0-7c2d1f19d813/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/08354f7c-f67f-4137-9189-90a8eb5296ce

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fb32b75843442aef11caec3b9d988811b47aba63557dbf8508f31d75d8fb49ab/

Threat name:

Win32.Trojan.Emotet

Status:

Malicious

First seen:

2021-11-16 11:12:12 UTC

AV detection:

24 of 28 (85.71%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=7mzlowcdiqvo6eok5q5z3geicg2hvotdkv637bii6moxlwh3jgvq._file

Verdict:

malicious

Label(s):

emotet

Result

Malware family:

emotet

Score:

10/10

Tags:

family:emotet botnet:epoch4 banker trojan

Link:

https://tria.ge/reports/211116-navg4sddg8/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Blocklisted process makes network request

Emotet

Malware Config

C2 Extraction:

81.0.236.93:443
94.177.248.64:443
66.42.55.5:7080
103.8.26.103:8080
185.184.25.237:8080
45.76.176.10:8080
188.93.125.116:8080
103.8.26.102:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080