MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f31917bd3aeaffb8de38f01fc96a3d9a0ca11ac5bc4ee9646908c53279833099. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f31917bd3aeaffb8de38f01fc96a3d9a0ca11ac5bc4ee9646908c53279833099
SHA3-384 hash: 32f176ef3d7801c102991865867bd7cbbe3e21db35896fd72788a574f23655a281b85f4e00a2d14a2752879341d49515
SHA1 hash: c129acd8aaa8ddab0fed775ed2711693d24011da
MD5 hash: 0af4684fd9e39c5387d17181627dba64
humanhash: sweet-august-august-sierra
File name:kpt1cab
Download: download sample
Signature Gozi
Create hunting rule
File size:200'704 bytes
First seen:2020-07-09 09:28:12 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash ac883ddb00fa3cf71a0c44c343ff4cf6 (6 x Gozi)
ssdeep 6144:OMsfznCFQ3r/r5Xt76/0Ni8mvXDKhc2au:3smQ93A86eq
Threatray 812 similar samples on MalwareBazaar
TLSH 7C14E1147E90EA79C01F9139D821CA74673DBC41AFA080E739DA1FEF7B622E05676246
Reporter JAMESWT_WT
Tags:Gozi

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/23642/
Detection(s):
SecuriteInfo.com.BScope.Trojan.Wacatac.31076.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Using the Windows Management Instrumentation requests
Creating a window
Searching for the window
DNS request
Creating a file
Detection:
isfb
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f31917bd3aeaffb8de38f01fc96a3d9a0ca11ac5bc4ee9646908c53279833099/
Threat name:
Win32.Infostealer.Gozi
Create hunting rule
Status:
Malicious
First seen:
2020-07-09 09:30:08 UTC
File Type:
PE (Dll)
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
4410cfd4fd242717a56d892466b563576af0ca4dd4738ab52a8ad818c2386073
Gozi
562be8984ba2629bba153f053977bb0ef17942bfefdb610a8eb618d955ded112
Gozi
6314b0e524291f6dd24410351d917e3069d041928e2d9a115a246f45794d3d91
Gozi
6a39a3e7387f3d214042b2d9d99f4d6de18303d56ad96c9a48df20cf4693091b
Gozi
a1a6e3603e050afbe4bd74f714f4bfc69f9f7ff51fc7e6e890a1eab04ccf1737
Gozi
c19f0f58518d482c6ce5da4ba3710dbafaec9d25cb1fba400cf355dfb99284b3
Gozi
c81150d0d07583bfc8201f12f2587e760eaa988eff34bfab4bdb662b91f34242
Gozi
ceafed22728ab72aa4a74dc2fc96d54b85ec0432ef0c97a4497075cc802109d3
Gozi
d25a610f735383649e5e4d48cd370fee127c04e101cf8e922e96d4ce88991cd9
Gozi
f53226476a8190fb69a366544e4f394e50e487c429977165a5efdd9e1dbec83e
Gozi
+ 802 additional samples on MalwareBazaar
Result
Malware family:
gozi_ifsb
Create hunting rule
Score:
  10/10
Tags:
banker trojan family:gozi_ifsb
Link:
https://tria.ge/reports/200709-kmkqp8gps2/
Behaviour
Checks whether UAC is enabled
Modifies Internet Explorer settings
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of FindShellTrayWindow
Gozi, Gozi IFSB
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/23642/

Comments