MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 244bd22b299305418f66c5a6239c70bdc5eced7c0464210feaac591301241cd5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 244bd22b299305418f66c5a6239c70bdc5eced7c0464210feaac591301241cd5
SHA3-384 hash: 60e9bf3a983fd29a1368e4de073dd60cb1c566572bdf3cdc6898971878d8fb4c245a355473291264b30515c009bc8877
SHA1 hash: 4c7d59a2e85623d6506a738fe456936afc460746
MD5 hash: 6ee5f47935a9791e16bfab62e9ae3f46
humanhash: item-wisconsin-winner-timing
File name:zte.dll
Download: download sample
Signature Gozi
Create hunting rule
File size:484'864 bytes
First seen:2020-06-10 06:13:14 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 8576f2eda7a30aeed43fccdbadabc440 (16 x Gozi, 10 x ZLoader)
ssdeep 12288:T2s615360KPnJHFlswhjmoUYtIdySZYBk:TZ8VZ8jmotI2S
Threatray 693 similar samples on MalwareBazaar
TLSH 96A4D0E25940B2B0D14BC97E9420B1B681F97C2A7F549180F98B47B735372FAA994FC3
Reporter abuse_ch
Tags:dll geo Gozi MailChannels POL ZLoader


Avatar
abuse_ch
Malspam distributing ZLoader:

HELO: buffalo.elm.relay.mailchannels.net
Sending IP: 23.83.212.24
From: Orange <info3@moviesfb.net>
Subject: e-faktura 06.2020
Attachment: faktura_85.xlsm

ZLoader payload URL:
https://erpoweredent.at/3/zte.dll

ZLoader C2:
https://militanttra.at/owg.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.ZLoader
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 06:15:05 UTC
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
gozi
Create hunting rule
zloader
Create hunting rule
Similar samples:
0eb381723057cbec531c209a0b5dca273d5c05ca5832b4d7baa2447d32e861cf
Gozi
54fba19e9bdd0cdc7f3900f716e90dfa0f96c282c768747d667d2b227ccbe484
Gozi
66d4f17726f5853e6127da6c02b6760f5cabbcf2793673d0db6b93517a537a78
Gozi
8179cb45ba2d6df0d25f9e1f382c5b9e8b9b703e4404fa19a9002c78418dedea
Gozi
8dbbc783a02a103f860b387d4c62c278b47c234e5ad4331eda1ba6ed7b06194f
Gozi
8e8ac33ad3757a7f33a24efbe9ec50a57d33de94a99327fdc38a9d8c3b21ad9b
Gozi
97acd15ebfaa1ac340cac6a4575d59d03ee08eb9b825eebf674d4ed123dd5667
Gozi
98a58a4f1a0b1305c473eeafa6dac80c2e2edd7e8aa8fe6d32ccac81318de1e5
Gozi
9ce2908edf0994f493926514628054634858340fb73f219c38c013f34dd9a429
Gozi
fa240d61efeb769d33cc081f2086ae6b65cda847a80440c82d97867fd1fbd6ab
Gozi
+ 683 additional samples on MalwareBazaar
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
family:zloader botnet:bot5 campaign:bot5 botnet persistence trojan
Link:
https://tria.ge/reports/201109-c4ajw42bsn/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Zloader, Terdot, DELoader, ZeusSphinx
Malware Config
C2 Extraction:
https://militanttra.at/owg.php
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ZLoader

Excel file xlsm c32da6643f80c121dddc359855f9e0e56110411fb90f0f988eed33277e945ae9

Gozi

DLL dll 244bd22b299305418f66c5a6239c70bdc5eced7c0464210feaac591301241cd5

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/385275/
  
Dropped by
MD5 9f2b0660c41b04b780aa280a469c160a
  
Dropped by
SHA256 c32da6643f80c121dddc359855f9e0e56110411fb90f0f988eed33277e945ae9
  
Delivery method
Distributed via web download

Comments