MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 385be4267e9aaadfb82815d54dde7fccbd0d1b843aa3c4062ef752a9378ae02e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 385be4267e9aaadfb82815d54dde7fccbd0d1b843aa3c4062ef752a9378ae02e
SHA3-384 hash: 730042227fadac8a777d6cd7cb380f5bc74ddbc563d53a6e444fd17e0894a8aa75e43404ea74d74842a105876314f204
SHA1 hash: 5597ab4de1ceed30abd713b17ed3ff35c14ea86b
MD5 hash: dd1900c39145034cc7e78e3ef8bfc2a8
humanhash: december-kentucky-lactose-fruit
File name:a.dll
Download: download sample
Signature Gozi
Create hunting rule
File size:993'280 bytes
First seen:2020-05-25 18:26:55 UTC
Last seen:2020-05-25 21:37:57 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash ac1351a4eb5ca40844aa8713198e2625 (1 x Gozi)
ssdeep 24576:xTgxz2gNOPstppFQ5GfBhoFaZJU4KYdWRZwsLFB11u0n:1glTD5UrYdWRGs3q0
Threatray 39 similar samples on MalwareBazaar
TLSH 0E255A01BA90E03DF877067D893BC6A89428BE208FB895D776C07A5F16767D0AE30757
Reporter threathive
Tags:Gozi ZLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Zbot
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 18:12:32 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
17 of 31 (54.84%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
zloader
Create hunting rule
gozi
Create hunting rule
Similar samples:
1267b822cde1edabfc063458232a5ed9ea03652416de96b8d12ecb1058c86e23
Gozi
3712c1a9e9ab864ee28897d0802179db4a2f664f61629f1154437640be377530
Gozi
6593fa326b8eb0b737a17889c50c539ac45f2f9215fdab50ffa62df1be7ec2d1
Gozi
692c58e28e0f0346adfbad2356dd8495ec8f07718ee40db171b50e8870526f96
Gozi
7d5ef8e6c5738ebc13718eee67f0b6cc354f3e28b135e4a378f69d57043299b8
Gozi
abe31666e7b408ed139ba7452f70d3f633b7cc7ce0de9de8b8c6489f47a34df8
Gozi
b8f848f137a23fe046b4701a67d07c8e7e1a8fdb066f318424caede7a1e69530
Gozi
cc32eb0fb5c35376f69a3d6b81fdb339309d06d80a2cffa2604e21012ac33c18
Gozi
ccf1e6416673f50f016cfa1658e9dd29793195b9bc701fedc1218d122faeb6b2
Gozi
eecaf5677c5c21d268261eef35a819549dda3c454e9b60e368070aa3bfd2f54c
Gozi
+ 29 additional samples on MalwareBazaar
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
family:zloader botnet:miguel campaign:25/05 botnet trojan
Link:
https://tria.ge/reports/201109-w271b1jtzn/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Zloader, Terdot, DELoader, ZeusSphinx
Malware Config
C2 Extraction:
https://tentrhetarav.gq/wp-parser.php
https://slidirinisprec.ml/wp-parser.php
https://iedison.vip/wp-parser.php
https://financiallifecoaching.com/wp-parser.php
https://fly2go.cn/wp-parser.php
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_unidentified_023_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gozi

DLL dll 385be4267e9aaadfb82815d54dde7fccbd0d1b843aa3c4062ef752a9378ae02e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/368192/
  
Delivery method
Distributed via web download

Comments