MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7398048e3cb424344def184f417b3cbfa1451bf0fa8219c875be0f195468c46d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7398048e3cb424344def184f417b3cbfa1451bf0fa8219c875be0f195468c46d
SHA3-384 hash: aeddb8b7e567860c448af4f21c88c5bb236ff6f9205c289d1abf187ae4b4be0f21406c72450dfb22de072799a7433c2d
SHA1 hash: 74d46362809aba7cb169b418227f7b000b530159
MD5 hash: 160b66a9019647b09cf0cf35b4f1bd77
humanhash: wolfram-four-oranges-fix
File name:5f0d6f9edec69.bin
Download: download sample
Signature Gozi
Create hunting rule
File size:223'232 bytes
First seen:2020-07-14 08:59:53 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 49c3f6b6a728d5380eb20e879b92f34f (3 x Gozi)
ssdeep 3072:QNDBySkXOGbpxg6G7VSufNLq2rP6leDKTGCTklen8Fl2Jvfwl:WwSc4lpLqUPXkk9vSfw
Threatray 695 similar samples on MalwareBazaar
TLSH 00246B61388EE47AE60B5B3E8C02E5B91642BC51CBB9B4C335EB1F6F571B1C746603A4
Reporter JAMESWT_WT
Tags:Gozi Gozi$ isfb Ursnif

Intelligence

File Origin
# of uploads :
1
# of downloads :
402
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/25631/
Detection(s):
SecuriteInfo.com.Generic.mg.160b66a9019647b0.12111.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Using the Windows Management Instrumentation requests
Creating a window
Searching for the window
DNS request
Detection:
isfb
Create hunting rule
Link:
https://mwdb.cert.pl/sample/7398048e3cb424344def184f417b3cbfa1451bf0fa8219c875be0f195468c46d/
Threat name:
Win32.Trojan.Ursnif
Create hunting rule
Status:
Malicious
First seen:
2020-07-14 09:01:05 UTC
File Type:
PE (Dll)
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=oomajdr4wqsditppdbhuc6z4x6qukg7q7kbbtsdvxyhrsvdiyrwq._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
346b977e05b99881c7ec168c2fa0b68f84ec633d764eb52dd9795e372f45b1b4
Gozi
34fd926b213a1c5726124dff74dbf69c731f8e823168d17cc1c9448501ed314f
Gozi
3a24a5ef5c6045ff597b4b76d9070f7beae8fb6ca791f9bac231673f2bd62759
Gozi
54256f630247bd09af0bc01c2dafe121b8d7334b4bbd1f36092da2e66e3983c5
Gozi
577423ddac7ca6f9b623e528452e4455015d71aa690d44a026c40c6dcaad9569
Gozi
591c648b11ffd7b4ed631793786ca67075b6d2f4e362716cc6b5ac24f2b7961f
Gozi
c9605153d7530d299bd0938837491114de48ee49eb6f25a5bad8c20705989dc0
Gozi
e3b9e0c9c3637a620a1fd51cf8bcf63bfe988193fc18fa7eb7a4d19e3b9ee467
Gozi
edaad6c9c254f0799e1c6528ac77483cf2700cd934202e0f60f04f8d155c4f5e
Gozi
f53226476a8190fb69a366544e4f394e50e487c429977165a5efdd9e1dbec83e
Gozi
+ 685 additional samples on MalwareBazaar
Result
Malware family:
gozi_ifsb
Create hunting rule
Score:
  10/10
Tags:
banker trojan family:gozi_ifsb
Link:
https://tria.ge/reports/200714-vh86ch6n7j/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of FindShellTrayWindow
Modifies system certificate store
Checks whether UAC is enabled
Modifies Internet Explorer settings
Gozi, Gozi IFSB
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/25631/

Comments