MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fc7c123cfb20fe56f35e99ec3de319beac00e0aa1d4b24c3c6a1526c159846cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet (aka Heodo)

Vendor detections: 9

Intelligence 9 IOCs YARA File information Comments

SHA256 hash:	fc7c123cfb20fe56f35e99ec3de319beac00e0aa1d4b24c3c6a1526c159846cb
SHA3-384 hash:	45b7d8c72be65908371e63c3ea7a9b7938d2794fabf8272e1827bed77e96e242296383826169e527d547df0671bfa1a2
SHA1 hash:	ec9a4ce37b7d0275a9a83c63ed9aa13690689d16
MD5 hash:	871143e023c8eae01c4a54eb803e1e0e
humanhash:	texas-october-grey-happy
File name:	emotet_exe_e5_fc7c123cfb20fe56f35e99ec3de319beac00e0aa1d4b24c3c6a1526c159846cb_2021-11-17__093810.exe
Download:	download sample
Signature	Heodo Create hunting rule
File size:	258'560 bytes
First seen:	2021-11-17 09:38:15 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	c50e47fa2c7197441952918ce6851ec0 (118 x Heodo)
ssdeep	6144:M1QMyNKCAdudRtiVNC+aFMTu90Y7TCWTBqSBC:M1OsrPNyFMTQuWTE
Threatray	113 similar samples on MalwareBazaar
TLSH	T1DC44BF00B1809032D9FE593945F9D96A4ABC7A610F80DDDF63D80DBA4B775C2B6309AF
Reporter	Cryptolaemus1
Tags:	dll Emotet epoch5 exe Heodo

Cryptolaemus1

Emotet epoch5 exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/206741/

Detection(s):

Win.Malware.Generic-9909860-0

Result

Verdict:

Clean

Maliciousness:

Behaviour

Launching a process

DNS request

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/6194cdbd43e8f62b6696c785/reports/5aae058f-290e-41ba-aaa2-d0db13f89931/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/f8a961fc-7aa9-44d7-8c77-388ba8214345

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fc7c123cfb20fe56f35e99ec3de319beac00e0aa1d4b24c3c6a1526c159846cb/

Threat name:

Win32.Trojan.Emotet

Status:

Malicious

First seen:

2021-11-17 09:39:08 UTC

AV detection:

24 of 28 (85.71%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7r6beph3ed7fn426thwd3yyzx2wabyfkdvfsjq6gufjgyfmyi3fq._file

Verdict:

malicious

Label(s):

emotet

Result

Malware family:

emotet

Score:

10/10

Tags:

family:emotet botnet:epoch5 banker trojan

Link:

https://tria.ge/reports/211117-lmmlxshhh6/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in System32 directory

Blocklisted process makes network request

Emotet

Malware Config

C2 Extraction:

51.178.61.60:443
168.197.250.14:80
45.79.33.48:8080
196.44.98.190:8080
177.72.80.14:7080
51.210.242.234:8080
185.148.169.10:8080
142.4.219.173:8080
78.47.204.80:443
78.46.73.125:443
37.44.244.177:8080
37.59.209.141:8080
191.252.103.16:80
54.38.242.185:443
85.214.67.203:8080
54.37.228.122:443
207.148.81.119:8080
195.77.239.39:8080
66.42.57.149:443
195.154.146.35:443