MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f54d245e7fdffb4b6886f2e68c401c4afde2637359aa5f0fb2b1a1c2eadde6c3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f54d245e7fdffb4b6886f2e68c401c4afde2637359aa5f0fb2b1a1c2eadde6c3
SHA3-384 hash: 5407338539ea4cb94e21db03b7af6eac5c1ef4945426fe24aca9ba3089b95ef88f69581daa595e9e60d3ebb791efdd23
SHA1 hash: edb8186b49a2d028e59cd391ffb2e86d99d182eb
MD5 hash: 26250f41b5bc651b9954417ca60ccc08
humanhash: spring-hydrogen-paris-king
File name:SecuriteInfo.com.Trojan.Dridex.704.495.29814
Download: download sample
Signature Gozi
Create hunting rule
File size:662'528 bytes
First seen:2020-06-02 19:31:56 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 9b6633e85c68c0277bf2da68b640f509 (15 x Gozi, 2 x ZLoader)
ssdeep 12288:yFyxomntU5cu7cGDD+pJ7ZwwF3E+pgUbRzFyWBaobi/jDnQAVVR/VUR:yFyxomntU5dapcuxpgKHmPjVR/VU
Threatray 41 similar samples on MalwareBazaar
TLSH 36E4BE05B791D038F9B726F98EBEA1B8943D7DA05B2494CB23C41AEF55246F1AC30727
Reporter SecuriteInfoCom
Tags:Gozi

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Dridex.704.495.29814.UNOFFICIAL
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 19:35:58 UTC
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
01173873e92d5dd520fa88e8587ec05c92e3f36f6136b8ff50fd1b0b13df1401
Gozi
16e5ddfcf4902431e2566a2a04424e1b0236d2958647bd57b7075be0013c3de1
Gozi
26625bd8081701ab5a248b4f6e726cd5ef07b43c817e5499b766f89980532952
Gozi
2f93f6e6c2f2c3a9e9e62c976fde8668fe6c99aaba02809217ad5c2e1ac0227a
Gozi
79c2eadd88f3fb91479d982e6b36d5dc7c2d465ff9580a434241f7b353c33289
Gozi
8914aa5433f7284881402dc27336d96baa74c6e7ce16f28531bb917c1dfa3e0f
Gozi
8e0238b207985132e60e6f5bc764a6756bce554f9c27b922f1d7e40950a3bbdc
Gozi
ad658b2da165f31ac7649cf909c5b3330f2e3efde15f0196edc0f90f462965ea
Gozi
bb0063629c3a51ea01a188e9f89e0a8b2ca68030d0cdaac6bd84cd100007cfc3
Gozi
f93cb3cd80e276260d8d31bbd91c975749971fcb92f0aa758120e1d0d774851d
Gozi
+ 31 additional samples on MalwareBazaar
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
family:zloader botnet:bot5 campaign:bot5 botnet trojan
Link:
https://tria.ge/reports/201109-tzqrnyh97a/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Zloader, Terdot, DELoader, ZeusSphinx
Malware Config
C2 Extraction:
https://militanttra.at/owg.php
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments