MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c19f0f58518d482c6ce5da4ba3710dbafaec9d25cb1fba400cf355dfb99284b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c19f0f58518d482c6ce5da4ba3710dbafaec9d25cb1fba400cf355dfb99284b3
SHA3-384 hash: 5aacb208d9dbed7c8d93dc802c852aee7f227c864f2a321a20ddd59d9eec867fd56b9b3f3eb329184764eb2fa43866b3
SHA1 hash: ce0da44c03d7458d6b0d897c14ad2655304c7cb8
MD5 hash: 7a0d1598dc50a8b48ed8287d36cc3211
humanhash: pluto-louisiana-magnesium-jersey
File name:kpt12cab
Download: download sample
Signature Gozi
Create hunting rule
File size:200'704 bytes
First seen:2020-07-09 10:17:15 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash ac883ddb00fa3cf71a0c44c343ff4cf6 (6 x Gozi)
ssdeep 6144:OMs1znCFQ3r/r5Xt76/0Ni8mvXDKhc2au:3sAQ93A86eq
Threatray 995 similar samples on MalwareBazaar
TLSH 2C14E1147E90EA79C01F9139D821CA74673DBC41AFA080E739DA1FEF7B622E05676246
Reporter JAMESWT_WT
Tags:Gozi isfb Ursnif

Intelligence

File Origin
# of uploads :
1
# of downloads :
301
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.BScope.Trojan.Wacatac.32421.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Using the Windows Management Instrumentation requests
Creating a window
Searching for the window
DNS request
Creating a file
Detection:
isfb
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c19f0f58518d482c6ce5da4ba3710dbafaec9d25cb1fba400cf355dfb99284b3/
Threat name:
Win32.Trojan.Ursnif
Create hunting rule
Status:
Malicious
First seen:
2020-07-09 10:19:05 UTC
File Type:
PE (Dll)
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
4410cfd4fd242717a56d892466b563576af0ca4dd4738ab52a8ad818c2386073
Gozi
562be8984ba2629bba153f053977bb0ef17942bfefdb610a8eb618d955ded112
Gozi
6314b0e524291f6dd24410351d917e3069d041928e2d9a115a246f45794d3d91
Gozi
6a39a3e7387f3d214042b2d9d99f4d6de18303d56ad96c9a48df20cf4693091b
Gozi
a1a6e3603e050afbe4bd74f714f4bfc69f9f7ff51fc7e6e890a1eab04ccf1737
Gozi
c81150d0d07583bfc8201f12f2587e760eaa988eff34bfab4bdb662b91f34242
Gozi
ceafed22728ab72aa4a74dc2fc96d54b85ec0432ef0c97a4497075cc802109d3
Gozi
d25a610f735383649e5e4d48cd370fee127c04e101cf8e922e96d4ce88991cd9
Gozi
f31917bd3aeaffb8de38f01fc96a3d9a0ca11ac5bc4ee9646908c53279833099
Gozi
f53226476a8190fb69a366544e4f394e50e487c429977165a5efdd9e1dbec83e
Gozi
+ 985 additional samples on MalwareBazaar
Result
Malware family:
gozi_ifsb
Create hunting rule
Score:
  10/10
Tags:
banker trojan family:gozi_ifsb
Link:
https://tria.ge/reports/200709-sx5d8chwzn/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of FindShellTrayWindow
Checks whether UAC is enabled
Modifies Internet Explorer settings
Gozi, Gozi IFSB
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/23668/

Comments