MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 abe31666e7b408ed139ba7452f70d3f633b7cc7ce0de9de8b8c6489f47a34df8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gozi

Vendor detections: 5

Intelligence 5 IOCs YARA File information Comments

SHA256 hash:	abe31666e7b408ed139ba7452f70d3f633b7cc7ce0de9de8b8c6489f47a34df8
SHA3-384 hash:	04f31b5f61fe5d63b6b491bfd3a376003ea5a3ddab5e8d831a9ed6e39b817c918232f3a969c36894936ce8dbdbb9e23e
SHA1 hash:	224f9ad58d323a9275c444accd753e85bd136de1
MD5 hash:	73901da4dd68170dd35059791789d777
humanhash:	missouri-bacon-magazine-wisconsin
File name:	tu.dll
Download:	download sample
Signature	Gozi Create hunting rule
File size:	1'162'240 bytes
First seen:	2020-05-26 16:24:34 UTC
Last seen:	2020-05-26 17:02:58 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	8a9eb8902462e936ba5087615507f564 (1 x Gozi)
ssdeep	24576:B4ggX/qn/7qE6uAyyirYmbna0CPL81QYH:Zgvqn/GE6Jy5MmzUotH
Threatray	38 similar samples on MalwareBazaar
TLSH	47358D40B791D035F9FB0AB98D7991AE593D7E610B24D0C7A3C06ADF1A366D4AE30713
Reporter	abuse_ch
Tags:	dll Gozi ZLoader

abuse_ch

ZLoader payload URL:
https://pensstomductchatlihet.tk/ew/tu.dll

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Zloader

Link:

https://www.capesandbox.com/analysis/4882/

Detection(s):

PUA.Win.Packer.PrivateExeProte-11

Gathering data

Threat name:

Win32.Trojan.Kryptik

Status:

Malicious

First seen:

2020-05-26 16:36:12 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

19 of 48 (39.58%)

Threat level:

2/5

Verdict:

malicious

Label(s):

zloader

gozi

Result

Malware family:

zloader

Score:

10/10

Tags:

family:zloader botnet:26/05 botnet trojan

Link:

https://tria.ge/reports/201109-j9n46amy9n/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Blacklisted process makes network request

Zloader, Terdot, DELoader, ZeusSphinx

Malware Config

C2 Extraction:

https://cripuntisispoi.tk/wp-parser.php
https://unesrafho.cf/wp-parser.php
http://sannyjewelry.ir/wp-parser.php
http://printgenerator.sundaytimes.lk/wp-parser.php

Please note that we are no longer able to provide a coverage score for Virus Total.