MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 061c271c0617e56aeb196c834fcab2d24755afa50cd95cc6a299d76be496a858. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	061c271c0617e56aeb196c834fcab2d24755afa50cd95cc6a299d76be496a858
SHA3-384 hash:	941b30a2106c8a6ad16de3310486dac3020c272a8e31facc49f2a6b6d214c9ed7e5d0f5983cee7c7e1003d62377cc4de
SHA1 hash:	8796dfe929e1f9d507a4c7da048fb80eeaed94eb
MD5 hash:	700d3ea5098e7b7f45fceec4df9df798
humanhash:	salami-wisconsin-grey-angel
File name:	gozi loader.bin
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	40'960 bytes
First seen:	2023-03-19 05:47:14 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	1640d668d1471f340cbe565fe63522f6 (15 x Gozi)
ssdeep	768:4gYKd2Usr2yS5PLHBjderMpEvpZi7/kMPWq9aky77XTm9:4fKdpfh5zHzeApsnI/eZDLI
Threatray	439 similar samples on MalwareBazaar
TLSH	T12403E1230D24A0ABEB0FC7F0675FA1BED3F9810536149867D6223A366DB3475823B685
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	0xToxin
Tags:	7709 exe Gozi

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

906

Origin country :

IL

Vendor Threat Intelligence

ANY.RUN

Malware family:

n/a

ID:

1

File name:

gozi loader.bin

Verdict:

No threats detected

Analysis date:

2023-03-19 05:48:37 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/ec011e38-87e8-49b3-924f-7b7d4d602e1c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/375437/

ClamAV Detected

Detection(s):

Win.Malware.GoziISFB-9940853-2

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Using the Windows Management Instrumentation requests

DNS request

Sending a custom TCP request

Certego Dragonfly Suspicious

Result

Malware family:

n/a

Score:

  5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/73867/overview

Behaviour

MalwareBazaar

CheckCmdLine

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

overlay packed

Link:

https://www.filescan.io/uploads/6416a213c65d1ebf04c179e0/reports/129d1932-e71d-49ee-8fe1-2828f9dae2bb/overview

Hybrid Analysis Razy.Generic

Verdict:

Malicious

Labled as:

Razy.Generic

Link:

https://www.hybrid-analysis.com/sample/061c271c0617e56aeb196c834fcab2d24755afa50cd95cc6a299d76be496a858

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Ursnif

Malware family:

Ursnif

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ff55716e-25d8-41e8-99ed-ab7a37557f93

Joe Sandbox Ursnif

Result

Threat name:

Ursnif

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1196822

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found API chain indicative of debugger detection

Found evasive API chain (may stop execution after checking system information)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Writes or reads registry keys via WMI

Writes registry values via WMI

Yara detected Ursnif

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB gozi

Detection:

gozi

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/061c271c0617e56aeb196c834fcab2d24755afa50cd95cc6a299d76be496a858/

ReversingLabs TitaniumCloud Win32.Trojan.Casdet

Threat name:

Win32.Trojan.Casdet

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-03-19 05:48:05 UTC

File Type:

PE (Exe)

AV detection:

24 of 24 (100.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ayocohagc7swv2yznsbu7svs2jdvll5fbtmvzrvcthlwxzewvbma._file

Threatray gozi

Verdict:

malicious

Label(s):

gozi

Alert

Create hunting rule

Similar samples:

19a9a43b36d2ed6516e4b1d8368cb3af64362507d2b30f4cb742fbe50780ee89

Gozi

38befee4c4513de47e667544d9f705f56c195393b116fcd154755c1f7815ae55

Gozi

3af96098ccb1063f1538e255f328e78f9556e29cd0563c53d2a73569759b5d0e

Gozi

7c854a125b0d2613bbfcd1fb3664c03c61bc3787ec8bde6be11a2f75692da268

Gozi

a9f25933eb0dc82972d77854034dbc86220088eff4758a7df4e65f87ee1745e1

Gozi

aa96b7f6516f3f8d7d63d61a30b3af156b92b3e8dace05c8953dcf82ac96a3c6

Gozi

c95c8b01e7a58afbae1b0c3a795108ae46b22c3867680dcdb883ca97e6f092a0

Gozi

cff404581196accfce86e8ba7a5b8f63b686ef831e384d95e46a04f908e0987a

Gozi

dcc33bc510228ff4cf4dc286e5902be5a262e3def4189960c702d27b83da84b2

Gozi

fc74e8faf8772293f2947c803c5309c64310c38d8e3f8efe18271004a9b96bba

Gozi

+ 429 additional samples on MalwareBazaar

Hatching Triage gozi

Result

Malware family:

gozi

Alert

Create hunting rule

Score:

  10/10

Tags:

family:gozi botnet:7709 banker isfb trojan

Link:

https://tria.ge/reports/230319-ghfklahb71/

Behaviour

Gozi

Malware Config

C2 Extraction:

checklist.skype.com
62.173.141.252
31.41.44.33
109.248.11.112

UnpacMe ISFB_Main win_isfb_auto

Unpacked files

SH256 hash:

876860a923754e2d2f6b1514d98f4914271e8cf60d3f95cf1f983e91baffa32b

MD5 hash:

2beb711bcfd441ca2d92da0313823a41

SHA1 hash:

ebc1777b9ef7242892e8479f3330ed561c370127

Detections:

ISFB_Main

Alert

Create hunting rule

win_isfb_auto

Alert

Create hunting rule

Link:

https://www.unpac.me/results/f65f5daa-8c3b-41d9-9033-bab029a6269f/

Parent samples :

3b3e3f142508409133b565c5ee076574340c6d2eded21b8294db1156c9474858
876860a923754e2d2f6b1514d98f4914271e8cf60d3f95cf1f983e91baffa32b
9d1e71b94eab825c928377e93377feb62e02a85b7d750b883919207119a56e0d
05b73bccd726df4df86b10b00b2ed4d6e6ba9832e3b473dd7abe6c50c8d5bfbf
061c271c0617e56aeb196c834fcab2d24755afa50cd95cc6a299d76be496a858

SH256 hash:

061c271c0617e56aeb196c834fcab2d24755afa50cd95cc6a299d76be496a858

MD5 hash:

700d3ea5098e7b7f45fceec4df9df798

SHA1 hash:

8796dfe929e1f9d507a4c7da048fb80eeaed94eb

Link:

https://www.unpac.me/results/f65f5daa-8c3b-41d9-9033-bab029a6269f/

VMRay Ursnif

Malware family:

Ursnif

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/061c271c0617/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.94

Link:

https://yomi.yoroi.company/submissions/061c271c0617e56aeb196c834fcab2d24755afa50cd95cc6a299d76be496a858

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/375437/