MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02d165251fbb673606e8c48754a9d5e4682317b5a277e71ad541d252e107aa74. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 7


Intelligence 7 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 02d165251fbb673606e8c48754a9d5e4682317b5a277e71ad541d252e107aa74
SHA3-384 hash: 7f9da89253223380986307539c7942835bd372c2f103f7f51dd4824e71764abd7a43c92d1419fc52979d47352b102046
SHA1 hash: 0a5cf542342a579a2da13fe81f2a33e8beb2dd53
MD5 hash: 7f1d3c53b9ec4e4a0de133e294c59503
humanhash: iowa-idaho-september-connecticut
File name:02d165251fbb673606e8c48754a9d5e4682317b5a277e71ad541d252e107aa74
Download: download sample
Signature Gozi
Create hunting rule
File size:280'504 bytes
First seen:2020-11-10 10:54:57 UTC
Last seen:2024-07-24 10:45:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9dc243a68580a369b65d2a13d2500bd9 (3 x Gozi)
ssdeep 6144:qz3t44nGH7RP7lOcQ/m05SYDwPDuNZOQszyOQJZWB:qrbGbRjlOcQ/mQY6NZRTRZWB
Threatray 127 similar samples on MalwareBazaar
TLSH 335423C156314CF0F6CCEFF7C8A6682437E017277AC1B99D8EA4C88D64FA0EA85455A7
Reporter seifreed
Tags:Gozi

Intelligence

File Origin
# of uploads :
2
# of downloads :
111
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Upx-4
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %AppData% subdirectories
Creating a file in the %temp% subdirectories
Running batch commands
Creating a process with a hidden window
Creating a process from a recently created file
Launching a process
DNS request
Sending an HTTP GET request
Changing a file
Creating a window
Setting browser functions hooks
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Unauthorized injection to a browser process
Deleting of the original file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/02d165251fbb673606e8c48754a9d5e4682317b5a277e71ad541d252e107aa74/
Threat name:
Win32.Trojan.Ursnif
Create hunting rule
Status:
Malicious
First seen:
2020-11-10 10:56:53 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=aliwkji7xnttmbxiysdvjkov4rucgf5vuj36ogwvihjffyihvj2a._file
Verdict:
malicious
Similar samples:
0fefdfbc442c4667670b1b9001f1b586dbf7d7eeb13bcaf21af53984d5ad14a6
Gozi
2a80deaa083bb554ccc57c0ffd467b4fd1a6e2f1ae6ab1a3de140aab849b19bf
Gozi
493d258253c3d4b39ae41b07ae583164926731a9d1b17c434cca2b8fa9c80629
Gozi
60924e938260500bea6ca3a3475455bdea8ec70ad6df3358f2f867460061c535
Gozi
63a8687b9f3d1ef090cbd4f3c78edb9ff645ead16c5eacb05debf14e418596f4
Gozi
78cb6053d76d453fb3885f47c1634fc28e20862a5a73bcdc1557e5620ae7416f
Gozi
7d56b15beb55a2a77afce882394f2ca64a5477ae0ba35536309b19a785d688d3
Gozi
acdbf9fccd6e9fef6459322fb9ea0b1767815413a9a9d91407b87c7834ae77a0
Gozi
e3c98c2ca7e4be4d14e9040f22c4a88bc512cb0e8d093af37360d035e45c5678
Gozi
e5420c67e6613cf86f490123904ea3ae05187932f3282b8fa25d94959b0a5bc2
Gozi
+ 117 additional samples on MalwareBazaar
Result
Malware family:
ursnif
Create hunting rule
Score:
  10/10
Tags:
family:gozi_ifsb family:ursnif banker persistence spyware trojan upx
Link:
https://tria.ge/reports/201110-nw3yhg9cax/
Behaviour
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of SetThreadContext
Adds Run key to start application
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
UPX packed file
Gozi, Gozi IFSB
Ursnif, Dreambot
Unpacked files
SH256 hash:
02d165251fbb673606e8c48754a9d5e4682317b5a277e71ad541d252e107aa74
MD5 hash:
7f1d3c53b9ec4e4a0de133e294c59503
SHA1 hash:
0a5cf542342a579a2da13fe81f2a33e8beb2dd53
Link:
https://www.unpac.me/results/a51c69ca-a90d-47eb-bb6b-845ec0efe961/
SH256 hash:
d9bb11357aeeec78090500c743a67dc92a156c5069801208030800994875b23e
MD5 hash:
f1beb0d90555390accb9f390db77c03d
SHA1 hash:
6c43db12feacbd94800d0a630af307d089210f1f
Link:
https://www.unpac.me/results/a51c69ca-a90d-47eb-bb6b-845ec0efe961/
SH256 hash:
037540f86fa69b4d4b33af3ed738000ddc7aad8a0a535e3b7ec82154db4b1304
MD5 hash:
17a44ac6fa5d4246c52b0fc3fb0db1df
SHA1 hash:
e94737f2604556a6ceb3727d156ac86dc442a882
Link:
https://www.unpac.me/results/a51c69ca-a90d-47eb-bb6b-845ec0efe961/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:GoziRule
Create hunting rule
Author:CCN-CERT
Description:Win32.Gozi
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:Ursnif
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Ursnif(a.k.a. Dreambot, Gozi, ISFB) in memory
Reference:internal research
Rule name:Ursnif3
Create hunting rule
Author:kevoreilly
Description:Ursnif Payload
Rule name:win_isfb_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments