MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0829886e0ca34a32fa545e0a53d7a2208d963b7b826a14aefde94d9ff4f549e5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0829886e0ca34a32fa545e0a53d7a2208d963b7b826a14aefde94d9ff4f549e5
SHA3-384 hash: 5cb59190485e852ec48d1149293cda64af176d3812194aca79239b436d782344eb6310654dc4eb1c133a9ed4346bb394
SHA1 hash: 506f12db29a31402f06d0ba84c359d6b20b6ab2f
MD5 hash: ac14aff179621af15cee44be450abeaf
humanhash: bacon-yankee-arkansas-johnny
File name:june9.dll
Download: download sample
Signature Gozi
Create hunting rule
File size:503'296 bytes
First seen:2020-06-10 05:59:24 UTC
Last seen:2025-03-13 13:36:21 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 260441d5ca8d9f18f1b88c86dd5a5a50 (2 x ZLoader, 1 x Gozi)
ssdeep 12288:uDKxKMk8ChMNo+e8kGOK9ab4ozUWdBENcYcj6D9r6W3FaOi:uDjMk8IMNYnGOSSjgW41QEv1aO
Threatray 231 similar samples on MalwareBazaar
TLSH CAB4D0D12A40B2B4E14F893D9421A07281BCBC652F14D4D1FA878BBB3A374FA9954FD7
Reporter abuse_ch
Tags:dll Gozi ZLoader


Avatar
abuse_ch
ZLoader payload URL:
http://205.185.122.246/files/june9.dll

Intelligence

File Origin
# of uploads :
3
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 03:42:08 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
gozi
Create hunting rule
zloader
Create hunting rule
Similar samples:
09fe435d0a761f4ebf0a28d7c023bb5448f5b924f3296f5054392996a521fc11
Gozi
34fc69d9d5119015a1f946f18069d1464c45e02b5716b91ae2c99eb493ef7242
Gozi
35ca27864b77f11e1d8bd7bc5902f535a056e12a888e06e1daf2bcf278b6a8b3
Gozi
5c616e633ee33cf1ebc784661459a1990201bc9baf77c6c59a8ee5d1b25dcde4
Gozi
63576b3bcc6c0509b9855aaa0ff27fa949da6f878e39cedf0f1bbb504aff7a98
Gozi
8ad2241815c24934b523082e603316065818decfe0d4897d4a6dee84626c5dfa
Gozi
969ca1f1cd74be7951552e6d03ee91abda18255b1761dfd46e049737ab0db12d
Gozi
9f8f76b6e791499bedf04630e7942a2e2d4792969d3c219b598f7a20596f767a
Gozi
c653365657fbf65429ad845d0a0d93106e972aca929739560ff4b4796bd2be08
Gozi
f99107fb49e1a9ae31d72e1a052baa79ce419ce970bc521010885c98a3d6e6ac
Gozi
+ 221 additional samples on MalwareBazaar
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
family:zloader botnet:june08 campaign:june botnet trojan
Link:
https://tria.ge/reports/201109-j4enps2882/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Zloader, Terdot, DELoader, ZeusSphinx
Malware Config
C2 Extraction:
http://snnmnkxdhflwgthqismb.com/post.php
http://nlbmfsyplohyaicmxhum.com/post.php
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gozi

DLL dll 0829886e0ca34a32fa545e0a53d7a2208d963b7b826a14aefde94d9ff4f549e5

(this sample)

  
Link
https://isc.sans.edu/diary/26222
  
URLhaus
https://urlhaus.abuse.ch/url/385268/
  
Delivery method
Distributed via web download

Comments