MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 06b3f14f359d4286bf5323824f637e082e876b9c1de0002109ff23e336ff9062. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 06b3f14f359d4286bf5323824f637e082e876b9c1de0002109ff23e336ff9062
SHA3-384 hash: 0c9405fa84611a69d8fb9b7bf50bf9679af5b08ec58affaa9eca6bb2e84a92c31e09db05d23a556c80f5555224886d3d
SHA1 hash: 741c09198b5544330a9f31bc83c2d7b4bb3059ce
MD5 hash: be278775008a27bc991a461302080d98
humanhash: island-blossom-mango-august
File name:647fab34ad681.dll
Download: download sample
Signature Gozi
Create hunting rule
File size:321'024 bytes
First seen:2023-06-06 21:59:30 UTC
Last seen:2023-06-08 04:42:03 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 8ab7e55c59f2d55cd0d51132c305b100 (1 x Gozi)
ssdeep 6144:xEqBRfInTf6orO1sypgkYKZqhoDCFV8u:xEqBRf6fyp5XZqhYCFV8u
Threatray 107 similar samples on MalwareBazaar
TLSH T15B644B00F2C3B02AE8F711B9956A92382D197F60776791CB22C4EE6D697C6C36E30757
TrID 42.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
22.3% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
14.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.1% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 32e9e46c9c9edbde (1 x Gozi)
Reporter pr0xylife
Tags:5050 dll Gozi mikehp-com

Intelligence

File Origin
# of uploads :
2
# of downloads :
310
Origin country :
DE DE
Vendor Threat Intelligence
Detection:
UrsnifV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/396270/
Detection(s):
SecuriteInfo.com.Win32.BotX-gen.25351.4586.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
lolbin packed shell32.dll xpack
Link:
https://www.filescan.io/uploads/647fac647798c0cc4acd5305/reports/c7d526fb-691a-4ea2-9504-1a1a70872048/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/06b3f14f359d4286bf5323824f637e082e876b9c1de0002109ff23e336ff9062
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/433a8006-ab77-49ae-84d5-d38266b3d8ce
Result
Threat name:
Ursnif
Create hunting rule
Detection:
malicious
Classification:
bank.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1249873
Signature
Allocates memory in foreign processes
Changes memory attributes in foreign processes to executable or writable
Creates a thread in another existing process (thread injection)
Disables SPDY (HTTP compression, likely to perform web injects)
Found malware configuration
Injects code into the Windows Explorer (explorer.exe)
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Sigma detected: Dot net compiler compiles file from suspicious location
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to steal Mail credentials (via file / registry access)
Writes or reads registry keys via WMI
Writes registry values via WMI
Writes to foreign memory regions
Yara detected Ursnif
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 882889 Sample: 647fab34ad681.dll Startdate: 07/06/2023 Architecture: WINDOWS Score: 100 109 Snort IDS alert for network traffic 2->109 111 Found malware configuration 2->111 113 Malicious sample detected (through community Yara rule) 2->113 115 3 other signatures 2->115 9 mshta.exe 19 2->9         started        11 loaddll32.exe 7 2->11         started        15 mshta.exe 2->15         started        17 2 other processes 2->17 process3 dnsIp4 19 powershell.exe 9->19         started        103 dretils.com 11->103 143 Writes to foreign memory regions 11->143 145 Writes or reads registry keys via WMI 11->145 147 Writes registry values via WMI 11->147 23 regsvr32.exe 6 11->23         started        26 cmd.exe 1 11->26         started        28 rundll32.exe 6 11->28         started        36 2 other processes 11->36 30 powershell.exe 15->30         started        105 192.168.2.1 unknown unknown 17->105 32 powershell.exe 17->32         started        34 powershell.exe 17->34         started        signatures5 process6 dnsIp7 81 C:\Users\user\AppData\...\rv20nzht.cmdline, Unicode 19->81 dropped 117 Injects code into the Windows Explorer (explorer.exe) 19->117 119 Writes to foreign memory regions 19->119 121 Modifies the context of a thread in another process (thread injection) 19->121 38 explorer.exe 19->38 injected 41 csc.exe 19->41         started        51 2 other processes 19->51 99 dretils.com 23->99 123 System process connects to network (likely due to code injection or exploit) 23->123 125 Writes or reads registry keys via WMI 23->125 127 Writes registry values via WMI 23->127 44 rundll32.exe 1 6 26->44         started        101 dretils.com 28->101 47 control.exe 28->47         started        129 Maps a DLL or memory area into another process 30->129 131 Creates a thread in another existing process (thread injection) 30->131 53 3 other processes 30->53 55 3 other processes 32->55 57 3 other processes 34->57 49 rundll32.exe 36->49         started        file8 signatures9 process10 dnsIp11 133 Tries to steal Mail credentials (via file / registry access) 38->133 135 Changes memory attributes in foreign processes to executable or writable 38->135 137 Writes to foreign memory regions 38->137 141 5 other signatures 38->141 59 cmd.exe 38->59         started        69 4 other processes 38->69 83 C:\Users\user\AppData\Local\...\rv20nzht.dll, PE32 41->83 dropped 61 cvtres.exe 41->61         started        107 dretils.com 91.215.85.164, 49708, 49709, 49710 PINDC-ASRU Russian Federation 44->107 139 Writes registry values via WMI 44->139 63 control.exe 44->63         started        65 rundll32.exe 47->65         started        85 C:\Users\user\AppData\Local\...\sy2olgct.dll, PE32 51->85 dropped 67 cvtres.exe 51->67         started        87 C:\Users\user\AppData\Local\...\zausc5ot.dll, PE32 53->87 dropped 89 C:\Users\user\AppData\Local\...\xbav1lqv.dll, PE32 53->89 dropped 71 2 other processes 53->71 91 C:\Users\user\AppData\Local\...\y5rfphvn.dll, PE32 55->91 dropped 93 C:\Users\user\AppData\Local\...\v5yumbbv.dll, PE32 55->93 dropped 73 2 other processes 55->73 95 C:\Users\user\AppData\Local\...\gpkuiuwj.dll, PE32 57->95 dropped 97 C:\Users\user\AppData\Local\...\5ek0wgwu.dll, PE32 57->97 dropped 75 2 other processes 57->75 file12 signatures13 process14 process15 77 conhost.exe 59->77         started        79 rundll32.exe 63->79         started       
Detection:
gozi
Create hunting rule
Link:
https://mwdb.cert.pl/sample/06b3f14f359d4286bf5323824f637e082e876b9c1de0002109ff23e336ff9062/
Threat name:
Win32.Trojan.TrickbotCrypt
Create hunting rule
Status:
Malicious
First seen:
2023-06-06 22:00:06 UTC
File Type:
PE (Dll)
Extracted files:
8
AV detection:
16 of 37 (43.24%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=a2z7ctzvtvbinp2teobe6y36baxio244dxqaaiij74r6gnx7sbra._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
0423fd21a639d16d71c50b15fdf96b7e19690583b2aee6f25443329d0e8ea0eb
Gozi
06864a9cd9890f3c1aad6bdc5dfbfb799e68f5f90a99b6146ca70850d0a249a1
Gozi
65f687a5c0e757cd8e296f8b0453b27726e5017502e93dcb8379d59fe9c056a3
Gozi
7ad0db9da1c28e6d12826b846ee3c82bda649e00d717cb2c4aefeaed56ea48ce
Gozi
8291f9579288153e0a1812c6c528563634c5c41b0916c606f7d8b4544ccc381a
Gozi
9c8d5a09d9f9634876274d50349dcc617ad7f354aad6e71762e08b089f40fec1
Gozi
d42f53c75818af4aae281a0c3f760e20643852405d69134d03f6ba5c62efe316
Gozi
d50570c1b4d064fb1f6e855d0c27ac1958a7a32c3cef5e6373094d82647f5bd4
Gozi
ea2d71af9790b0a058d0d166c52c2609a1a106053189c515b6059b5f18e9e48b
Gozi
ebd73a3f010aa3cf01059a4c08f9f70d0d7d4d671e76d024e5dfd60b27e92a66
Gozi
+ 97 additional samples on MalwareBazaar
Result
Malware family:
gozi
Create hunting rule
Score:
  10/10
Tags:
family:gozi botnet:5050 banker isfb trojan
Link:
https://tria.ge/reports/230606-1wmevafh25/
Behaviour
Suspicious use of WriteProcessMemory
Gozi
Malware Config
C2 Extraction:
https://fazz.bing.com/check
dretils.com
Unpacked files
SH256 hash:
707249d581c36c659bfb7089c150232da01c1256db172a413deda117daff9975
MD5 hash:
201f6e6a198903064b1fa59b2b61d2e8
SHA1 hash:
fa4bc39f4ccee24dac684ed32786b7878941cf40
Link:
https://www.unpac.me/results/5e4bbd31-ebe0-45f9-ac48-2a7da23258a4/
SH256 hash:
ea0144646d3cc7c36b4e8dfcd270be004b8a9060373a6c0aef7c5082d0e3ac6d
MD5 hash:
5acd7d8fa698b26daccea6362ac6c089
SHA1 hash:
c7a55b0c9f6a38e41c6315537beeba5aa7563a64
Link:
https://www.unpac.me/results/5e4bbd31-ebe0-45f9-ac48-2a7da23258a4/
SH256 hash:
a2c59a517b15887f20e0183d920412b17c6dc77f7eafbb434f37faab0a4d7757
MD5 hash:
9ef8d885645eda3a8e1cc37ada96a4cc
SHA1 hash:
295c25d68f7d9d145a54ddc0b7f7034aea133ec0
Detections:
ISFB_Main
Create hunting rule
win_isfb_auto
Create hunting rule
Link:
https://www.unpac.me/results/5e4bbd31-ebe0-45f9-ac48-2a7da23258a4/
SH256 hash:
06b3f14f359d4286bf5323824f637e082e876b9c1de0002109ff23e336ff9062
MD5 hash:
be278775008a27bc991a461302080d98
SHA1 hash:
741c09198b5544330a9f31bc83c2d7b4bb3059ce
Link:
https://www.unpac.me/results/5e4bbd31-ebe0-45f9-ac48-2a7da23258a4/
Malware family:
Ursnif
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/06b3f14f359d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/06b3f14f359d4286bf5323824f637e082e876b9c1de0002109ff23e336ff9062

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_peb_parsing
Create hunting rule
Author:Willi Ballenthin
Rule name:win_isfb_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.isfb.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/396270/

Comments