MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 207465ded4b4538b319e22188fdcfe0f42480386e77be00582192b58dcd7e0ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 207465ded4b4538b319e22188fdcfe0f42480386e77be00582192b58dcd7e0ac
SHA3-384 hash: e30f534b97faf74b61eba330c5ca762abb8722320e0d141386933b05ac7f7ad10a74a746d153a176db9ac9b5c9e64ca1
SHA1 hash: 9a68634ee3351317b44ff6a8db0adf1bcd8ee0fb
MD5 hash: ca726cc5232ba8ea7c241db090e0b659
humanhash: grey-earth-winner-pip
File name:slk.dll
Download: download sample
Signature Gozi
Create hunting rule
File size:679'936 bytes
First seen:2020-06-01 07:47:02 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 14e4e458ac05dead43ce8aab18419077 (4 x Gozi)
ssdeep 12288:wuLkbWpcOhwLgz98a2HyAQrSIz4YnqoCi/2RWo9Drxkck+tMGgigEmkVo:w3bWpcOhwMilH2WPoD+Rv9Rk8gamyo
Threatray 27 similar samples on MalwareBazaar
TLSH 1AE4DF3A3A1095BAD20F4ABE4857C4F849B1BD54973540C736C2CBA7173368B89F4F9A
Reporter abuse_ch
Tags:dll Gozi ZLoader


Avatar
abuse_ch
ZLoader payload URL:
https://urleddrug.at/3/slk.dll

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Cridex
Create hunting rule
Status:
Malicious
First seen:
2020-06-01 08:36:23 UTC
AV detection:
21 of 31 (67.74%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
01173873e92d5dd520fa88e8587ec05c92e3f36f6136b8ff50fd1b0b13df1401
Gozi
1b4e008beb2b395e53648c9a246ecafcb3df0543c5236a40cdb976a2007bbf97
Gozi
4de033878a6a1fadf566fa54c89d6f5c2b530907d82f89e44e2587bb19007521
Gozi
8564809c3aaa8e94463ec9ac0fb4e51c52c5e57a25ea09a997258184c656389a
Gozi
8914aa5433f7284881402dc27336d96baa74c6e7ce16f28531bb917c1dfa3e0f
Gozi
a6287780595058f07192b68b63c9a109ea7bb6222c58e29e00dbc5acad363a6a
Gozi
b580afe615e4e13cffbcd130379521dcfdd89c2b36a0ab1d4b5fef98814b141e
Gozi
bd0d1a5cc00640c72a4581df4d4c86caa627b07f1b8931920b9742855db35851
Gozi
cff2954919994abab58e207212181ca34d1350b553c79773b9cc7ed30fe481f4
Gozi
f54d245e7fdffb4b6886f2e68c401c4afde2637359aa5f0fb2b1a1c2eadde6c3
Gozi
+ 17 additional samples on MalwareBazaar
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
family:zloader botnet:bot5 campaign:bot5 botnet trojan
Link:
https://tria.ge/reports/201109-wrb9py2c6s/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Zloader, Terdot, DELoader, ZeusSphinx
Malware Config
C2 Extraction:
https://militanttra.at/owg.php
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ZLoader

Excel file xlsm e2092adac73f8bb456547a61815662e5ec01016ba9a7b0d2ab53eb316c9f4c5a

Gozi

DLL dll 207465ded4b4538b319e22188fdcfe0f42480386e77be00582192b58dcd7e0ac

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/373105/
  
Dropped by
MD5 425b80a2697d1a246f859dc207db7f91
  
Dropped by
SHA256 e2092adac73f8bb456547a61815662e5ec01016ba9a7b0d2ab53eb316c9f4c5a
  
Delivery method
Distributed via web download

Comments