🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0126855e2683ca2e9cabd23fcb39ceb5cc435a3f86f18b770375afb93e505eb9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0126855e2683ca2e9cabd23fcb39ceb5cc435a3f86f18b770375afb93e505eb9
SHA3-384 hash: 06f4f679a0a98545b3918bfa54b61889d24518e7b882fdd199de4767cd3c504a12e8cfc6678f249124c63591bd5aed89
SHA1 hash: 49bcf2d64b7eba9f0ebb700de2eb8fd8f1d37b6c
MD5 hash: 25f94ff087a7f6feedf2d24dd99b149d
humanhash: rugby-georgia-idaho-utah
File name:5cabc58.dll
Download: download sample
Signature Gozi
Create hunting rule
File size:291'752 bytes
First seen:2021-08-26 11:56:10 UTC
Last seen:2021-09-13 12:51:12 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 22fd56982b2e42fe8adf3de3e969056a (1 x Gozi)
ssdeep 6144:8fgMTSV3chL1l20Hta4jEy5stXcLOakz3lnAj728Ry80+DCE/Anmxcg:8fSRchL1E0EQEWstXAOakzlnA3y8fDnA
Threatray 6 similar samples on MalwareBazaar
TLSH T1AA548E66F3A40D96EDBBC479C9E78617E7F27C051250C30B63E1CA165F23B22B629361
Reporter 0x746f6d6669
Tags:exe Gozi

Intelligence

File Origin
# of uploads :
3
# of downloads :
1'166
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
5cabc58.dll
Verdict:
No threats detected
Analysis date:
2021-08-26 11:57:40 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/11cffd89-2d18-4dfa-a2bd-c252ffb05ccb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
HiddenVNC
Create hunting rule
Link:
https://www.capesandbox.com/analysis/182596/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4c19059d-aa1b-4b2f-acae-a040d65e8afc
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/839699
Signature
Antivirus / Scanner detection for submitted sample
Contains VNC / remote desktop functionality (version string found)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 472126 Sample: 5cabc58.dll Startdate: 26/08/2021 Architecture: WINDOWS Score: 80 44 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->44 46 Malicious sample detected (through community Yara rule) 2->46 48 Antivirus / Scanner detection for submitted sample 2->48 50 2 other signatures 2->50 8 loaddll64.exe 2 2->8         started        process3 process4 10 rundll32.exe 1 1 8->10         started        13 rundll32.exe 1 8->13         started        16 cmd.exe 1 8->16         started        18 4 other processes 8->18 dnsIp5 40 37.120.238.45, 443, 49737, 49738 SECURE-DATA-ASRO Romania 10->40 42 127.0.0.1 unknown unknown 10->42 20 WerFault.exe 9 10->20         started        52 System process connects to network (likely due to code injection or exploit) 13->52 23 rundll32.exe 1 16->23         started        25 WerFault.exe 9 18->25         started        27 WerFault.exe 9 18->27         started        signatures6 process7 file8 32 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 20->32 dropped 29 WerFault.exe 20 9 23->29         started        34 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 25->34 dropped 36 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 27->36 dropped process9 file10 38 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 29->38 dropped
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0126855e2683ca2e9cabd23fcb39ceb5cc435a3f86f18b770375afb93e505eb9/
Threat name:
Win64.Backdoor.DarkVnc
Create hunting rule
Status:
Malicious
First seen:
2021-08-26 11:56:20 UTC
AV detection:
12 of 26 (46.15%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
32733ed8cd439e049bff41a12686f66ddccf558a7ab68f4bfc014ec66bd0725b
Gozi
9e7156a3ee3d864ea24daa5db9c90bc9505e034ed45dab8115490fda05c113d9
Gozi
b1afe9e1801792dfe96eb0a6c71aa98f82067c5454526a7a524a41d5bb8814ac
Gozi
c9ac5bb27067f557bfe685c0f56e7f0c2c14cc20bfbcb630561edc266ab27fd3
Gozi
d98e07cfa7163a044ebc9b5d16bd57ee54030941a9fc1564d76b2f6c655573e4
Gozi
Result
Malware family:
gozi_ifsb
Create hunting rule
Score:
  10/10
Tags:
family:gozi_ifsb banker trojan
Link:
https://tria.ge/reports/210826-zfrqcv4y1a/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Blocklisted process makes network request
Gozi, Gozi IFSB
Unpacked files
SH256 hash:
0126855e2683ca2e9cabd23fcb39ceb5cc435a3f86f18b770375afb93e505eb9
MD5 hash:
25f94ff087a7f6feedf2d24dd99b149d
SHA1 hash:
49bcf2d64b7eba9f0ebb700de2eb8fd8f1d37b6c
Link:
https://www.unpac.me/results/a30bcef3-e022-489e-b6a4-b9661f4b63d6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.96
Link:
https://yomi.yoroi.company/submissions/0126855e2683ca2e9cabd23fcb39ceb5cc435a3f86f18b770375afb93e505eb9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win32_hvnc_banker_gen
Create hunting rule
Author:@VK_Intel
Description:Detects malware banker hidden VNC
Reference:https://twitter.com/VK_Intel/status/1247058432223477760
Rule name:crime_win32_hvnc_zloader1_hvnc_generic
Create hunting rule
Author:@VK_Intel
Description:Detects Zloader hidden VNC
Reference:https://twitter.com/malwrhunterteam/status/1240664014121828352
Rule name:HiddenVNC
Create hunting rule
Author:@bartblaze
Description:Identifies HiddenVNC, which can start remote sessions.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/182596/

Comments