MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6593fa326b8eb0b737a17889c50c539ac45f2f9215fdab50ffa62df1be7ec2d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gozi

Vendor detections: 6

Intelligence 6 IOCs YARA File information Comments

SHA256 hash:	6593fa326b8eb0b737a17889c50c539ac45f2f9215fdab50ffa62df1be7ec2d1
SHA3-384 hash:	a484a4a2496de753ed9924b7c4eae4b738e141819ff3823fc7a9d22ab27af86ff139112111a8f8d5225fc0378c2558d7
SHA1 hash:	69e3f9bbbf147d317da8bd59de3cdb3ca9043c6d
MD5 hash:	ff1ad63517df53adaefcbeecf71311a1
humanhash:	tennis-island-double-green
File name:	s.dll
Download:	download sample
Signature	Gozi Create hunting rule
File size:	1'083'392 bytes
First seen:	2020-05-15 06:49:54 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	e5b38e14e280e455beee0355833e1519 (1 x Gozi)
ssdeep	24576:4Bi+phcIJXxh60nA2QWXRE/tosVdCeKOkFDogAnpd5:4k4hcYXxA8P6OsCe1kF6pd5
Threatray	30 similar samples on MalwareBazaar
TLSH	82359D00B7519138F8BB06F99D7EA1AC993C7E601B2854CB72C469DF6A25AE0FC31717
Reporter	abuse_ch
Tags:	dll Gozi ZLoader

abuse_ch

ZLoader payload URL:
http://45.138.72.39/g/s.dll

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Zloader

Link:

https://www.capesandbox.com/analysis/3782/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.33845749.25770.29053.UNOFFICIAL

Result

Threat name:

Unknown

Detection:

malicious

Classification:

phis.evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/356784

Behaviour

Behavior Graph:

n/a

Gathering data

Threat name:

Win32.Trojan.Zloader

Status:

Malicious

First seen:

2020-05-14 15:29:08 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

21 of 31 (67.74%)

Threat level:

5/5

Verdict:

malicious

Label(s):

zloader

gozi

Result

Malware family:

zloader

Score:

10/10

Tags:

family:zloader botnet:miguel campaign:14/05 botnet trojan

Link:

https://tria.ge/reports/201109-th2h7wr3zj/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Blacklisted process makes network request

Zloader, Terdot, DELoader, ZeusSphinx

Malware Config

C2 Extraction:

https://kickapoochiefsfootball.com/wp-parser.php
https://appsbispo.tk/wp-parser.php
http://staging4.allemny.net/wp-parser.php
https://dinghaomcc.com/wp-parser.php
https://bondarenkopjatk.ru/wp-parser.php
http://euromix.com.ua/wp-parser.php

Please note that we are no longer able to provide a coverage score for Virus Total.