Hash / InfoValue
SHA256d8ca36406bfacdd794cc8bbc54f38b1c88116f1a180d4d069c3ad4a2210ef2f4
MD55ab2b28bc1e00519dcd55b67e9198c2c
SHA10b983184cf9e27707b80635e4ad5b0ea88de3bd6
ImpHashb7e07a5800cbc9c6f303fe6cbe1b23f1
File Adi5ab2b28bc1e00519dcd55b67e9198c2c
File Typeexe
Size331,776 bytes
First Seen2023-11-09

Tehdit Valuelendirmesi

Bu ornek, hedef sisteme ek zararlı yazılım yuklemek amacıyla tasarlanmis moduler bir yukleyici (loader) olarak tespit edilmistir. Bankacılık trojanları, fidye yazılımları veya diger ikinci asama yukler indirebilmektedir.

Detected Capabilities

  • Payload Indirme
  • Surec Enjeksiyonu
  • Kalicilik
  • Anti-Analiz
  • Sifrelenmis Iletisim

MalwareBazaar Tags

32EmotetexeHeodo

Analysis Note

Bu ornek Emotet ailesine ait ve MalwareBazaar platformundan alınmıstır. KEYDAL Guvenlik Arastirmaları tarafından metadata analizi gerceklestirilmis ve IOC veritabanına eklenmistir.

Emotet — Malware Profile

Emotet (Heodo/Mealybug/TA542) 32-bit DLL payload. Process enumeration via CreateToolhelp32Snapshot+Process32First/Next. VirtualAlloc+VirtualProtect shellcode staging. ntdll.dll direct calls. Low entropy 3.92 (stage-1 loader/encoded payload). Suspicious imagebase and DOS stub.

Malware Type
Loader
Programming Language
C
C2 Protocol
HTTP
Target Systems
Windows
Also Known As (AKA)
Heodo

Technical Details

C dili, HTTP C2 (RSA+AES sifreleme), modular yapi (email stealer, spreader, Outlook harvester), process hollowing, living off the land (regsvr32, mshta, certutil), Epoch1/2/3/4/5 botnet

Attribution / Threat Actor

TA542 (MUMMY SPIDER) - Ukrayna kokenli oldugu dusunulen organizasyon. 2021'de Europol/FBI tarafindan coguyla tutuklandi; 2022'de geri dondu.

Capabilities & Behavior

Payload İndirme
Süreç Enjeksiyonu
Modüler Mimari
Kimlik Bilgisi Hırsızlığı
Yanal Hareket
Kalıcılık
Anti-VM/Sandbox
İkincil Payload Dağıtımı

IOC List (2 indicators)

IOC — Emotet
# SHA256 d8ca36406bfacdd794cc8bbc54f38b1c88116f1a180d4d069c3ad4a2210ef2f4 # MD5 5ab2b28bc1e00519dcd55b67e9198c2c
TypeValueNote
sha256 d8ca36406bfacdd794cc8bbc54f38b1c88116f1a180d4d069c3ad4a2210ef2f4
md5 5ab2b28bc1e00519dcd55b67e9198c2c
Emotet — Go to Full Profile →

C2 Servers (7 recorded servers for this family)

Address Type Port Protocol Status Country
41.216.188.11 ip 8000 HTTP active —
103.143.173.206 ip 443 HTTPS inactive ID
144.91.65.153 ip 7080 HTTP inactive DE
195.88.54.144 ip 8080 HTTP sinkholed —
103.43.46.149 ip 443 HTTPS sinkholed —
185.220.101.32 ip 80 HTTP sinkholed DE
5.135.183.154 ip 8080 HTTP sinkholed FR

C2 addresses are provided only from malware samples manually verified by the KEYDAL team. Commercial use is prohibited.

Tags
32EmotetexeHeodo