MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb27ecf6bee0620962aa33d1fc0496a1a201b80b67b446fa9d25a9e67e32abca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gozi

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	cb27ecf6bee0620962aa33d1fc0496a1a201b80b67b446fa9d25a9e67e32abca
SHA3-384 hash:	88c6ab93d12875b60ad8eda5c477d43c216ac9b3a887c1e182fb56788ef311a76c656b433d00cf417eb50998667afeeb
SHA1 hash:	566f67d5854e838999dd310096b5f8d3f921f778
MD5 hash:	4edca3f93e15bf1678215530d7eb7142
humanhash:	seventeen-uncle-magazine-ten
File name:	4edca3f93e15bf1678215530d7eb7142.exe
Download:	download sample
Signature	Gozi Create hunting rule
File size:	197'632 bytes
First seen:	2020-05-19 06:27:36 UTC
Last seen:	2020-05-19 08:05:17 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	ce0c3d9c48154107536f23ff72da7fc4 (1 x Gozi, 1 x Glupteba, 1 x CoinMiner)
ssdeep	3072:dBNShIgsHSg5M7xtojgidoRMU59bgD/SIJcpEw:jXIRNtojpd1obmB
Threatray	359 similar samples on MalwareBazaar
TLSH	3114C09173D3C772C55705324871DAA09A3BAF21F7338A4727B41A6E5E302F06A7739A
Reporter	abuse_ch
Tags:	exe Gozi

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.BehavesLike.Win32.MultiPlug.ch.18243.UNOFFICIAL

Gathering data

Threat name:

Win32.Trojan.Kryptik

Status:

Malicious

First seen:

2020-05-19 06:37:01 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

24 of 31 (77.42%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=zmt6z5v64brasyvkgpi7ybewugradoalm62en6u5ewu6m7rsvpfa._file

Result

Malware family:

gozi_ifsb

Score:

10/10

Tags:

family:gozi_ifsb banker trojan

Link:

https://tria.ge/reports/201109-trkay6pcxe/

Behaviour

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Gozi, Gozi IFSB

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Ursnif Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Ursnif(a.k.a. Dreambot, Gozi, ISFB) in memory
Reference:	internal research

Rule name:	win_isfb_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gozi

exe cb27ecf6bee0620962aa33d1fc0496a1a201b80b67b446fa9d25a9e67e32abca

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/364131/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample