MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f53226476a8190fb69a366544e4f394e50e487c429977165a5efdd9e1dbec83e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f53226476a8190fb69a366544e4f394e50e487c429977165a5efdd9e1dbec83e
SHA3-384 hash: dcf52e2514a1ebd6d7cfe3687914ed62c07c69164b3904d96b6da1dbf3f0c6080500b7bfa9cbcd5aee6cb7b6f31ecc93
SHA1 hash: 84c2898de18da23a6be0543b6160598f8b7daa17
MD5 hash: 042194b12baff427770e37922b7a5cab
humanhash: chicken-missouri-high-helium
File name:kpt12
Download: download sample
Signature Gozi
Create hunting rule
File size:284'160 bytes
First seen:2020-07-09 15:05:12 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 315e8cf9a992171676708733e8d63a48 (10 x Gozi)
ssdeep 6144:qi8xXEVAaWrI54Pv8G4/prLvGiyvkV2KV:n8xuAaO2ov3kTakRV
Threatray 853 similar samples on MalwareBazaar
TLSH FC54BE0076D0E8B4E42E42388C60CAA5877EBD21EB7899E777D85F0F6E615C05E71F62
Reporter JAMESWT_WT
Tags:Gozi isfb Ursnif

Intelligence

File Origin
# of uploads :
1
# of downloads :
305
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/23958/
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Using the Windows Management Instrumentation requests
Creating a window
Searching for the window
DNS request
Creating a file
Detection:
isfb
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f53226476a8190fb69a366544e4f394e50e487c429977165a5efdd9e1dbec83e/
Threat name:
Win32.Trojan.Ursnif
Create hunting rule
Status:
Malicious
First seen:
2020-07-09 15:07:04 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
363d9a5910dac53138195fa18c8e43eb99360213ff1abdd5f2a1b0b34208fea7
Gozi
4410cfd4fd242717a56d892466b563576af0ca4dd4738ab52a8ad818c2386073
Gozi
562be8984ba2629bba153f053977bb0ef17942bfefdb610a8eb618d955ded112
Gozi
6a39a3e7387f3d214042b2d9d99f4d6de18303d56ad96c9a48df20cf4693091b
Gozi
977956121fd42c67dd015a0b6587d173bfe118f89d26fb653459d8c0e801d224
Gozi
a1a6e3603e050afbe4bd74f714f4bfc69f9f7ff51fc7e6e890a1eab04ccf1737
Gozi
a37a3be0bddd0cb696900b5acf220c32c40e9dfe8d2e41f85a4ca5c0e6fd9307
Gozi
b3dd5fabb9c05eaab15d95ba49d626cee83c8374bf2d965532d3214fdcfbf032
Gozi
f394be3f5bca6042b4c243810e61047cdc48802d278059ab03d07b2495e48704
Gozi
fb75efa8434d35a049d6608b6534df5c0716d33eb373f63cda5333796e16f1ec
Gozi
+ 843 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/200709-npnyjjb3a2/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of FindShellTrayWindow
Checks whether UAC is enabled
Modifies Internet Explorer settings
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of FindShellTrayWindow
Checks whether UAC is enabled
Modifies Internet Explorer settings
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/23958/

Comments