MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 038d149bf92158353f6297b89f6abe3de1c360d81b81fde38bdde90a0e28382a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 038d149bf92158353f6297b89f6abe3de1c360d81b81fde38bdde90a0e28382a
SHA3-384 hash: 44fc0eac549dc290fa8b2c7912fd4bf85d189946c1eb993c001cc33ee8bc99253555d85ca333e8c0d9cb6d921042b7fc
SHA1 hash: e372c8a56720e5afb2062d434fc880cf81f0b23c
MD5 hash: 0f7ef72fc550c1f92b5378b4c26efc93
humanhash: purple-alpha-california-maine
File name:7170000.dll
Download: download sample
Signature Gozi
Create hunting rule
File size:232'960 bytes
First seen:2022-10-04 12:59:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:TlfGqwJTeTEom3lIkR2SCD6q9KgyItk78mV0dfgxT/cqA9w5VgCK5hcjLctxJFoc:TlDosEPR66q9KgylInd6oqA9D5JnFoc
Threatray 103 similar samples on MalwareBazaar
TLSH T137346D5AE3E50995EDABD5B5CA53D217DBF234092B24D30F53B0CAA66F17722B21C302
TrID 28.8% (.EXE) DOS Executable Borland Pascal 7.0x (2035/25)
28.3% (.EXE) Generic Win/DOS Executable (2002/3)
28.3% (.EXE) DOS Executable Generic (2000/1)
14.2% (.SCORE) Music Craft Score (1007/6)
0.2% (.DBF) Sybase iAnywhere database files (19/3)
Reporter 0x746f6d6669
Tags:exe Gozi

Intelligence

File Origin
# of uploads :
1
# of downloads :
268
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/316525/
Detection(s):
Win.Malware.Ursnif-9884005-0
Create hunting rule

Win.Malware.Ursnif-9886559-0
Create hunting rule

Win.Malware.Ursnif-9892796-0
Create hunting rule

Win.Malware.Ursnif-9896448-0
Create hunting rule

Win.Malware.Ursnif-9917123-0
Create hunting rule

Win.Malware.Ursnif-9937854-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed setupapi.dll shell32.dll
Link:
https://www.filescan.io/uploads/633c2e6dd089a0c15dd50984/reports/85333534-53da-4b84-93f3-c8893cdcb9c1/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Ursnif
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9ade00e8-821a-4c61-b97e-5c7d3a6f63b4
Result
Threat name:
Ursnif
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1083254
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Ursnif
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 715820 Sample: 7170000.dll.exe Startdate: 04/10/2022 Architecture: WINDOWS Score: 64 17 Antivirus / Scanner detection for submitted sample 2->17 19 Multi AV Scanner detection for submitted file 2->19 21 Yara detected  Ursnif 2->21 7 loaddll64.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        11 conhost.exe 7->11         started        13 rundll32.exe 7->13         started        process5 15 rundll32.exe 9->15         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/038d149bf92158353f6297b89f6abe3de1c360d81b81fde38bdde90a0e28382a/
Threat name:
Win64.Infostealer.Gozi
Create hunting rule
Status:
Malicious
First seen:
2022-10-04 13:00:11 UTC
File Type:
PE+ (Dll)
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=aogrjg7zefmdkp3cs64j62v6hxq4gygydoa73y4l3xuqudrihava._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
154a3d6b6884c0ad1152f84d209053fc2dbabfadae47d22eb1486c83d001cfab
Gozi
3e099b9a4d2092444a335dad2a3ad688b4c981b1a5e4e522f489c59a3e6f4e6a
Gozi
555df9df7ab7a1edf7764add9ff88b1266a078d48ee1cc00f21f0131a6b30b84
Gozi
857ea4a7ea0b6903992bc62853453e780b8e8e6af87daa574660be322473b9fc
Gozi
b8ede90d77745ec6121d2ce8e06e85710855df06fe192788081f2b6ef6abb1d9
Gozi
cf043012ad2be371b8f945ac4952f79d9484f74d8e5fe9a08970d0df748927ab
Gozi
d7c21a2d7356de716a0d38bd83ca240c7c12b3830494ffde30e3599fa2243b5c
Gozi
dc641a85150af5ede0e9a4ab23144a578889bbee7163addf9e97b5fab7d09fc8
Gozi
e1885b84829f448f9d549144ea8221f422a9243a4693101a145c0836cc13fac1
Gozi
+ 93 additional samples on MalwareBazaar
Result
Malware family:
gozi_ifsb
Create hunting rule
Score:
  10/10
Tags:
family:gozi_ifsb botnet:200000
Link:
https://tria.ge/reports/221004-p8m2csbab4/
Malware Config
C2 Extraction:
trackingg-protectioon.cdn1.mozilla.net
45.8.158.104
188.127.224.114
weiqeqwns.com
wdeiqeqwns.com
weiqeqwens.com
weiqewqwns.com
iujdhsndjfks.com
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/3560e6d7-a4d9-47c5-b826-f5deea541f29
Unpacked files
SH256 hash:
038d149bf92158353f6297b89f6abe3de1c360d81b81fde38bdde90a0e28382a
MD5 hash:
0f7ef72fc550c1f92b5378b4c26efc93
SHA1 hash:
e372c8a56720e5afb2062d434fc880cf81f0b23c
Link:
https://www.unpac.me/results/ad4d5cd4-b485-43f1-8ba8-09ceeb8e707f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/038d149bf92158353f6297b89f6abe3de1c360d81b81fde38bdde90a0e28382a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/316525/

Comments