MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d04ce36b2c6a5888bf4c413ed5a1c8d2e16af857957742059e7f4de74d36d854. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gozi

Vendor detections: 4

Intelligence 4 IOCs YARA 2 File information Comments 2

SHA256 hash:	d04ce36b2c6a5888bf4c413ed5a1c8d2e16af857957742059e7f4de74d36d854
SHA3-384 hash:	e85c6deee05e2910d78ad5108342bd89a18c29f62abfbac1d3203e657ce587e3ae749995930f4d54f21c5cfaaf5a627c
SHA1 hash:	d017313cf274b1f3b7a337808dfdd1dfe6b28a75
MD5 hash:	e704302809da8bdef8e97ae3a05a4020
humanhash:	mango-twelve-maine-romeo
File name:	fattura.exe
Download:	download sample
Signature	Gozi Create hunting rule
File size:	289'792 bytes
First seen:	2020-04-24 06:42:36 UTC
Last seen:	2020-04-24 07:04:17 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	8376ac7b61d0aee6234f469f29a345d3 (1 x Gozi)
ssdeep	3072:T1VtixcMYquIv0s8M8B1cfCUqA7THyzHppuR0x+pCsFm3vN1r2XVWf:3tidYMUMQ1cKNKcKHQr2XVY
Threatray	446 similar samples on MalwareBazaar
TLSH	7754AE1177F1C072E2A705308961FBB14A77FC625B7155DB27A02F3B1E342E08676B5A
Reporter	jarumlus
Tags:	geo Gozi ITA

Intelligence

File Origin

# of uploads :

# of downloads :

114

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Win.Malware.Generic-7688662-0

Win.Dropper.Ursnif-7690682-0

Win.Dropper.Glupteba-7690688-0

Win.Malware.Generic-7691249-0

PUA.Win.Downloader.Aiis-6803892-0

Gathering data

Threat name:

Win32.Trojan.Glupteba

Status:

Malicious

First seen:

2020-04-24 07:35:26 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

28 of 31 (90.32%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=2bgog2zmnjmirp2mie7nlioi2lqwv6cxsv3uebm6p5g6otjw3bka._file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Ursnif Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Ursnif(a.k.a. Dreambot, Gozi, ISFB) in memory
Reference:	internal research

Rule name:	win_dreambot_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Gozi

xls 4b462d7cd8e4ba2d1da7332df73f99f89a4da71357fb855e9b9e8cc3949f40d6

Gozi

exe d04ce36b2c6a5888bf4c413ed5a1c8d2e16af857957742059e7f4de74d36d854

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/350489/

Dropped by

SHA256 4b462d7cd8e4ba2d1da7332df73f99f89a4da71357fb855e9b9e8cc3949f40d6

Dropped by

MD5 83bc60b05f4fe966447ca1f27babac56

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
AUTH_API	Manipulates User Authorization	ADVAPI32.dll::InitializeAcl
SECURITY_BASE_API	Uses Security Base API	ADVAPI32.dll::SetAclInformation
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::OpenProcess KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::FindFirstVolumeMountPointA KERNEL32.dll::LoadLibraryW KERNEL32.dll::GetVolumeInformationW KERNEL32.dll::GetStartupInfoW KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::WriteConsoleOutputCharacterW KERNEL32.dll::SetConsoleCtrlHandler KERNEL32.dll::SetConsoleCursorPosition KERNEL32.dll::SetConsoleOutputCP KERNEL32.dll::SetStdHandle
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileW KERNEL32.dll::GetWindowsDirectoryW
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegQueryMultipleValuesA
WIN_SVC_API	Can Manipulate Windows Services	ADVAPI32.dll::QueryServiceLockStatusW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

Corsin Camichel commented on 2020-04-24 08:10:59 UTC

dropped by f41d531cb5772db6fe63e8678280e73b0f98750bfbf9b781537d64f55758263f

commented on 2020-04-24 07:04:27 UTC

Malspam campaign sent from compromised email accounts, distributing Gozi in Italy. Example:

HELO: smtpcmd13150.aruba.it
Sending IP: 62.149.156.150
From: service <info@ndsoluzioni.it>
Subject: Il tuo ordine 64175193 e stato completato
Attachment: fattura_27.xls

Gozi payload URL:
http://gstat.hamiltoncustomhomesinc.com/fattura.exe