MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 18d16e00c1aec23905194caa6929efd4af4a8613cfec674e0752033a891b7c33. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 18d16e00c1aec23905194caa6929efd4af4a8613cfec674e0752033a891b7c33
SHA3-384 hash: cec264702bab56bae00fdfc1b297899207d7400460ca5bb552b56abe83115b1034a84153f9ad5a61748261902632cda8
SHA1 hash: 3c29c8dcdc90a19efdbe0b8cf14f7861da4a7086
MD5 hash: 02818a3bf4231a7a0a9ce6704a0d9ed0
humanhash: diet-maine-lion-pluto
File name:GMT
Download: download sample
Signature Gozi
Create hunting rule
File size:247'296 bytes
First seen:2020-06-22 07:25:35 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash b26f8e126e7f13723c339a4ac132d393 (1 x Gozi)
ssdeep 3072:EUBLF2u20QvP/JKI1Xyi6ssCmvOcNhJdXpUc/s/tZzqriVp6vmV+MHn/SugvpxXn:Rxuvs+HH6b3iVMPsgRxXPd/J
Threatray 671 similar samples on MalwareBazaar
TLSH 5234D0507991C879E2AEAEF90926C9B84A6D7C542F34ECA733D89E473F231809530D67
Reporter JAMESWT_WT
Tags:dll Ursnif

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Ursnif3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/12427/
Detection(s):
PUA.Win.Packer.PrivateExeProte-11
Create hunting rule

Detection:
isfb
Create hunting rule
Link:
https://mwdb.cert.pl/sample/18d16e00c1aec23905194caa6929efd4af4a8613cfec674e0752033a891b7c33/
Threat name:
Win32.Trojan.PackEmotet
Create hunting rule
Status:
Malicious
First seen:
2020-06-22 07:26:08 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
1007538050a92f07d23ac2be6956f577fbfd459381415b40a3b53b794a6d5211
Gozi
4f61fcafad37cc40632ad85e4f8aa503d63700761e49db19c122bffa7084e4ec
Gozi
52b9735c9182c90dcf54bb2d1ae287bd702417070fa3dd403232b0a5c26b857f
Gozi
77ded4f64eec0094fdfa843dfe4f36a559fbf8fa5c39fda7b63013def76ace7b
Gozi
8116f086d5b222ea6d3ac385bbc8f3a88c19f920435e1ba274a1f46702ab10a2
Gozi
ae618e94c64b10307de3193efe693ba4cf0ea371a662038f705ba00779ad4f40
Gozi
d5b2b88dab809a7cc7688d6358c2b2d78b0f5278c72226f79673fce1bfe3aafa
Gozi
d8885ce1f08167becda151811c6519af1bac2ad835acf60c7fa1130dad28fcd7
Gozi
dc0df8f5ee0e898e069643a84cbc8154d6191f081665e245f1a9e2085028062f
Gozi
fb75efa8434d35a049d6608b6534df5c0716d33eb373f63cda5333796e16f1ec
Gozi
+ 661 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/200624-1lxc6pdc92/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of FindShellTrayWindow
Checks whether UAC is enabled
Modifies Internet Explorer settings
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/12427/

Comments