MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a564910112b33b769485254ae891a16cbb5b91ad5a099408e290658698edc81a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a564910112b33b769485254ae891a16cbb5b91ad5a099408e290658698edc81a
SHA3-384 hash: f0e7bc23c4e5048c97b9ab78f3c8e74942b72c3d773085c4b3f7300598dccdcda81aeed813ad4cfbd6f8800b4a07edd0
SHA1 hash: efebe3b5f72975a95d86d31f0bc83f50815cc013
MD5 hash: 1d94cc32838b73795b6578564b80905a
humanhash: rugby-skylark-beer-early
File name:SecuriteInfo.com.FileRepMalware.20119
Download: download sample
Signature Gozi
Create hunting rule
File size:274'944 bytes
First seen:2020-04-24 17:41:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash bcecb8dcf49a67dc64ee326bb0b26c9f (2 x Gozi)
ssdeep 3072:T4V2okMvC/Lmgsy8tjXvTo1KXG1twU3360PWGBAQK4x+pCsFa3vN1rHf:TM2UkuyQjXLpW1tUCWi5uH0r/
Threatray 365 similar samples on MalwareBazaar
TLSH 1F44AD2077E1C072E2AB06718875DBB14A3AFC625B7051CB27971B7F2F242D086B675E
Reporter SecuriteInfoCom
Tags:Gozi

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Generic-7688662-0
Create hunting rule

Win.Dropper.Ursnif-7690682-0
Create hunting rule

Win.Dropper.Glupteba-7690688-0
Create hunting rule

Win.Malware.Generic-7691249-0
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Tofsee
Create hunting rule
Status:
Malicious
First seen:
2020-04-24 14:19:09 UTC
File Type:
PE (Exe)
Extracted files:
48
AV detection:
24 of 29 (82.76%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uvsjcaiswm5xnfefevforenbns5vxennliezichcsbsynghnzana._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
09804594bd9f7b89264ce8fb599523eac20d915ad0976787d00627cc49909e2a
Gozi
263d4bcfcc2e1cd9d3de9bbc585864861dda333cdd2e0158e3c47ff70540aefd
Gozi
744f341a285a15647220b1dda12600c38b754a5d810f0fc5240a96a9ee44714d
Gozi
75e3028aa0c2dfb079a4bf42a11bf65c6265d539fa4b6cb600cf144bdfba5df9
Gozi
7899aae710988b1ddf4fca1d1f70a5f57fcb67b8491ab935e82f2ed46eda0bfb
Gozi
92531c1c46721abadcbc92de961a40f50940f1409c31d84cbc8129ce860968e3
Gozi
cb27ecf6bee0620962aa33d1fc0496a1a201b80b67b446fa9d25a9e67e32abca
Gozi
cd4e2a8e52f9160e7d25e3a1cf0ee45a1b3c88831cb76e049622bd69170289c5
Gozi
d04ce36b2c6a5888bf4c413ed5a1c8d2e16af857957742059e7f4de74d36d854
Gozi
e7543c5dbc2378d3c4b6401f764764986e5c9773383f5837346af7e785528f3d
Gozi
+ 355 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ursnif
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Ursnif(a.k.a. Dreambot, Gozi, ISFB) in memory
Reference:internal research
Rule name:win_dreambot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gozi

Executable exe a564910112b33b769485254ae891a16cbb5b91ad5a099408e290658698edc81a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/350489/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::InitializeAcl
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::SetAclInformation
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::OpenProcess
KERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::FindFirstVolumeMountPointA
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::GetVolumeInformationW
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::WriteConsoleOutputCharacterW
KERNEL32.dll::SetConsoleCtrlHandler
KERNEL32.dll::SetConsoleCursorPosition
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleAliasW
KERNEL32.dll::GetConsoleOutputCP
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileW
KERNEL32.dll::GetWindowsDirectoryW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegQueryMultipleValuesA
WIN_SVC_APICan Manipulate Windows ServicesADVAPI32.dll::QueryServiceLockStatusW

Comments