MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 06e26611fe5cf2fb04cfa894f9cb24edc0ab8306cf42c979b2c776372d07d1cf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 06e26611fe5cf2fb04cfa894f9cb24edc0ab8306cf42c979b2c776372d07d1cf
SHA3-384 hash: 438a881e9e78fa47e3f6d7225cf22aaa2130f2ba6354353f1bb11d3b3493cfea828a9074c6c0042f8b4f02e9dda74827
SHA1 hash: f7eff5f67b1b794759ec0ba9b0d6a3bd5cd59bfe
MD5 hash: b6f0fc5638a110abac1a54805f77e786
humanhash: east-aspen-stairway-ack
File name:61ee6edf7de65.dll
Download: download sample
Signature Gozi
Create hunting rule
File size:97'280 bytes
First seen:2022-01-24 10:08:49 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 16fee73a0bcca61f5b30bccb8ad3cbcf (1 x Gozi)
ssdeep 1536:2V4a+Lezr4lBJMMTQH41pf951L6e9IImUTKpobwjB52DXjaWVghVBDmC6eUd:i8or4TJMKz951feKTKobwjkGWqNmfd
Threatray 438 similar samples on MalwareBazaar
TLSH T10B93C029FC4F9590FC9B7FB041A2F70D10E16AB5E76D45CB190399A8FA349CBAF15202
File icon (PE):PE icon
dhash icon 30696969e8aacccc (4 x IcedID, 1 x Gozi)
Reporter JAMESWT_WT
Tags:brt dll Gozi isfb Ursnif

Intelligence

File Origin
# of uploads :
1
# of downloads :
392
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/221886/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
DNS request
Using the Windows Management Instrumentation requests
Sending an HTTP GET request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/61ee7ac3f81da814af9f802e/reports/40e403c4-425e-4959-b427-f48ee2494fca/overview
Malware family:
Ursnif
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/242534e6-82da-4871-9663-eb64486a189a
Result
Threat name:
Ursnif
Create hunting rule
Detection:
malicious
Classification:
bank.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/926183
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Changes memory attributes in foreign processes to executable or writable
Creates a thread in another existing process (thread injection)
Disables SPDY (HTTP compression, likely to perform web injects)
Found malware configuration
Injects code into the Windows Explorer (explorer.exe)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Self deletion via cmd delete
Sigma detected: MSHTA Spawning Windows Shell
Sigma detected: Suspicious Call by Ordinal
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Writes or reads registry keys via WMI
Writes registry values via WMI
Writes to foreign memory regions
Yara detected Ursnif
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 558657 Sample: 61ee6edf7de65.dll Startdate: 24/01/2022 Architecture: WINDOWS Score: 100 96 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->96 98 Found malware configuration 2->98 100 Antivirus / Scanner detection for submitted sample 2->100 102 5 other signatures 2->102 9 loaddll32.exe 1 2->9         started        13 mshta.exe 19 2->13         started        15 mshta.exe 19 2->15         started        process3 dnsIp4 84 211.40.39.251, 49762, 80 LGDACOMLGDACOMCorporationKR Korea Republic of 9->84 86 121.136.102.4, 49765, 80 KIXS-AS-KRKoreaTelecomKR Korea Republic of 9->86 88 2 other IPs or domains 9->88 116 Writes to foreign memory regions 9->116 118 Allocates memory in foreign processes 9->118 120 Modifies the context of a thread in another process (thread injection) 9->120 122 3 other signatures 9->122 17 cmd.exe 1 9->17         started        19 control.exe 9->19         started        22 powershell.exe 34 13->22         started        24 powershell.exe 32 15->24         started        signatures5 process6 signatures7 26 rundll32.exe 1 17->26         started        104 Changes memory attributes in foreign processes to executable or writable 19->104 30 rundll32.exe 19->30         started        106 Injects code into the Windows Explorer (explorer.exe) 22->106 108 Writes to foreign memory regions 22->108 110 Modifies the context of a thread in another process (thread injection) 22->110 32 explorer.exe 22->32 injected 34 csc.exe 22->34         started        37 csc.exe 22->37         started        39 conhost.exe 22->39         started        112 Maps a DLL or memory area into another process 24->112 114 Creates a thread in another existing process (thread injection) 24->114 41 csc.exe 24->41         started        43 csc.exe 24->43         started        45 conhost.exe 24->45         started        process8 dnsIp9 90 138.36.3.134, 49761, 80 TEXNETSERVICOSDECOMUNICACAOEMINFORMATICALTDBR Brazil 26->90 92 61.98.7.132, 49763, 80 SKB-ASSKBroadbandCoLtdKR Korea Republic of 26->92 94 giporedtrip.at 91.203.174.38, 49760, 49764, 80 LITTEL-ASRU Uzbekistan 26->94 124 System process connects to network (likely due to code injection or exploit) 26->124 126 Writes to foreign memory regions 26->126 128 Allocates memory in foreign processes 26->128 138 3 other signatures 26->138 47 control.exe 26->47         started        130 Changes memory attributes in foreign processes to executable or writable 32->130 132 Self deletion via cmd delete 32->132 134 Disables SPDY (HTTP compression, likely to perform web injects) 32->134 136 Creates a thread in another existing process (thread injection) 32->136 50 cmd.exe 32->50         started        52 cmd.exe 32->52         started        54 cmd.exe 32->54         started        56 RuntimeBroker.exe 32->56 injected 76 C:\Users\user\AppData\Local\...\hddjt5kh.dll, PE32 34->76 dropped 58 cvtres.exe 34->58         started        78 C:\Users\user\AppData\Local\...\32ysuxeg.dll, PE32 37->78 dropped 60 cvtres.exe 37->60         started        80 C:\Users\user\AppData\Local\...\qmanv25g.dll, PE32 41->80 dropped 62 cvtres.exe 41->62         started        82 C:\Users\user\AppData\Local\...\vn3zgr4g.dll, PE32 43->82 dropped 64 cvtres.exe 43->64         started        file10 signatures11 process12 signatures13 140 Changes memory attributes in foreign processes to executable or writable 47->140 142 Injects code into the Windows Explorer (explorer.exe) 47->142 144 Writes to foreign memory regions 47->144 150 4 other signatures 47->150 146 Uses ping.exe to sleep 50->146 148 Uses ping.exe to check the status of other devices and networks 50->148 66 conhost.exe 50->66         started        68 PING.EXE 50->68         started        70 conhost.exe 52->70         started        72 PING.EXE 52->72         started        74 conhost.exe 54->74         started        process14
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/06e26611fe5cf2fb04cfa894f9cb24edc0ab8306cf42c979b2c776372d07d1cf/
Threat name:
Win32.Trojan.Ursnif
Create hunting rule
Status:
Malicious
First seen:
2022-01-24 10:10:38 UTC
File Type:
PE (Dll)
Extracted files:
3
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=a3rgmep6ltzpwbgpvckptsze5xakxaygz5bms6nsy53dolih2hhq._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
3fff4baf83e75e39c51a2484ca04763852b6d6bf0a24ecb341e65dd2724711a0
Gozi
45f11d97a8ed1a9215e9c6c8d44335229e17bd63bb0a48abcc8c2a02dca241c4
Gozi
4d4bedbc795e2dd4fe929b6dc57bfc314165795e25c362959fbabc59c0a60d80
Gozi
54ce5aedb7cc073c481eb8af96f89f3ab11e5decaccf942d033479fd0f04c8b3
Gozi
6c4a29e89016b49c854eaf4d7cf8ee4bcf8e58e1f7ccf4ced62df6a57e0b60ff
Gozi
73118c724e0d6cb9ce3072d66f2d20fb7e89189699faf60315395ad89b0a1a4d
Gozi
7739c03843a133370371b72a5552ba6a5cb36d5defbfb0b10b9580bb9c62a798
Gozi
aa4d5569f00d3fed84a25b4a1adcf28e55150e01cd5917082fa9569f774b984e
Gozi
+ 428 additional samples on MalwareBazaar
Result
Malware family:
gozi_ifsb
Create hunting rule
Score:
  10/10
Tags:
family:gozi_ifsb botnet:20000 banker trojan
Link:
https://tria.ge/reports/220124-l6sx2sebc2/
Behaviour
Discovers systems in the same network
Enumerates processes with tasklist
Gathers system information
Modifies Internet Explorer settings
Runs net.exe
Runs ping.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in System32 directory
Suspicious use of SetThreadContext
Deletes itself
Blocklisted process makes network request
Gozi, Gozi IFSB
Malware Config
C2 Extraction:
giporedtrip.at
habpfans.at
Unpacked files
SH256 hash:
e940424b7943191b9abba3a0def37b0943b628193b48c884d7ade31c0ca5997f
MD5 hash:
d3911f9ec14b85e2a3664474229cb256
SHA1 hash:
b06e16182093ec25a59149f0ca494e3308430ca8
Detections:
win_isfb_auto
Create hunting rule
Link:
https://www.unpac.me/results/3e79bde2-602f-4523-9b62-29b086cf7281/
SH256 hash:
a50763b18d767cc7b8b214f899cd656941b352d8f1ffcb3ff3537059ff85ca81
MD5 hash:
ec5564da570e723c15f57be8c81ec24e
SHA1 hash:
26cf30eacc3db9bad68c6d08c3455a30999f8633
Detections:
win_isfb_auto
Create hunting rule
Link:
https://www.unpac.me/results/3e79bde2-602f-4523-9b62-29b086cf7281/
SH256 hash:
06e26611fe5cf2fb04cfa894f9cb24edc0ab8306cf42c979b2c776372d07d1cf
MD5 hash:
b6f0fc5638a110abac1a54805f77e786
SHA1 hash:
f7eff5f67b1b794759ec0ba9b0d6a3bd5cd59bfe
Link:
https://www.unpac.me/results/3e79bde2-602f-4523-9b62-29b086cf7281/
Malware family:
Ursnif.Dreambot.D
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/06e26611fe5c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.21
Link:
https://yomi.yoroi.company/submissions/06e26611fe5cf2fb04cfa894f9cb24edc0ab8306cf42c979b2c776372d07d1cf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_isfb_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.isfb.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/221886/

Comments