MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d25a610f735383649e5e4d48cd370fee127c04e101cf8e922e96d4ce88991cd9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d25a610f735383649e5e4d48cd370fee127c04e101cf8e922e96d4ce88991cd9
SHA3-384 hash: 66185a03c90af3472519080638dd3afa3040d5d32d0412c94db61a2650191734fdf6a21d9128dcdfda10706cde90db9f
SHA1 hash: da8f942c661a951b6d91bd66e15d093bcb0864ec
MD5 hash: 24d036b68b3a1d64261e69f0a579f5d1
humanhash: carolina-thirteen-happy-lamp
File name:kpt4cab
Download: download sample
Signature Gozi
Create hunting rule
File size:200'704 bytes
First seen:2020-07-09 10:16:54 UTC
Last seen:2020-07-09 10:43:36 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash ac883ddb00fa3cf71a0c44c343ff4cf6 (6 x Gozi)
ssdeep 6144:OMslznCFQ3r/r5Xt76/0Ni8mvXDKhc2au:3swQ93A86eq
Threatray 607 similar samples on MalwareBazaar
TLSH 9914E1147E90EA79C01F9138D821CA74673DBC41AFA080E739DA1FEF7B622E05676246
Reporter JAMESWT_WT
Tags:Gozi isfb Ursnif

Intelligence

File Origin
# of uploads :
2
# of downloads :
298
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/23666/
Detection(s):
SecuriteInfo.com.BScope.Trojan.Wacatac.6719.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Using the Windows Management Instrumentation requests
Creating a window
Searching for the window
DNS request
Creating a file
Detection:
isfb
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d25a610f735383649e5e4d48cd370fee127c04e101cf8e922e96d4ce88991cd9/
Threat name:
Win32.Trojan.Ursnif
Create hunting rule
Status:
Malicious
First seen:
2020-07-09 10:18:08 UTC
File Type:
PE (Dll)
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
4410cfd4fd242717a56d892466b563576af0ca4dd4738ab52a8ad818c2386073
Gozi
562be8984ba2629bba153f053977bb0ef17942bfefdb610a8eb618d955ded112
Gozi
6314b0e524291f6dd24410351d917e3069d041928e2d9a115a246f45794d3d91
Gozi
6a39a3e7387f3d214042b2d9d99f4d6de18303d56ad96c9a48df20cf4693091b
Gozi
a1a6e3603e050afbe4bd74f714f4bfc69f9f7ff51fc7e6e890a1eab04ccf1737
Gozi
c19f0f58518d482c6ce5da4ba3710dbafaec9d25cb1fba400cf355dfb99284b3
Gozi
c81150d0d07583bfc8201f12f2587e760eaa988eff34bfab4bdb662b91f34242
Gozi
ceafed22728ab72aa4a74dc2fc96d54b85ec0432ef0c97a4497075cc802109d3
Gozi
f31917bd3aeaffb8de38f01fc96a3d9a0ca11ac5bc4ee9646908c53279833099
Gozi
f53226476a8190fb69a366544e4f394e50e487c429977165a5efdd9e1dbec83e
Gozi
+ 597 additional samples on MalwareBazaar
Result
Malware family:
gozi_ifsb
Create hunting rule
Score:
  10/10
Tags:
banker trojan family:gozi_ifsb
Link:
https://tria.ge/reports/200709-vl2vdb5k2e/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of FindShellTrayWindow
Checks whether UAC is enabled
Modifies Internet Explorer settings
Gozi, Gozi IFSB
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/23666/

Comments