🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a2b10135d3a172952ae033b91474801f0de67c29b2a85dc747417d8da12b853. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a2b10135d3a172952ae033b91474801f0de67c29b2a85dc747417d8da12b853
SHA3-384 hash: c7c8ea420e867e22e676ca1966fef809bf1d7af0da247dabcf4e577f1a908e641e3d98ff8139f34bf8a99d2aa08da5cd
SHA1 hash: fdb8598e443f640127bd841bc22ee2debd5cc9cf
MD5 hash: 3276454ebcedec7d26569941909ed591
humanhash: lithium-hawaii-india-vermont
File name:freeofice.dll
Download: download sample
Signature Gozi
Create hunting rule
File size:339'968 bytes
First seen:2022-04-12 11:17:02 UTC
Last seen:2022-04-12 11:43:55 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash bc8a4cfa38a985345c4181a337867930 (1 x Gozi)
ssdeep 6144:6SQ8kTHF8UH1LM5nrR0XPfDq2mFVwyFYsQ+3SwlyrVHN+2O:6SQBTHF5B4rR0/fDq2sVwyGZwYQ
Threatray 542 similar samples on MalwareBazaar
TLSH T1A47412DD443F3C92EEB662BFA20576AB4CADB90403F8C047D852E2ED81B587C85A45D7
Reporter JAMESWT_WT
Tags:dll Gozi isfb Ursnif

Intelligence

File Origin
# of uploads :
2
# of downloads :
920
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/262970/
Detection(s):
SecuriteInfo.com.Variant.Zusy.419984.31521.15340.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Launching a process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed setupapi.dll
Link:
https://www.filescan.io/uploads/62555fb2eab80a7a6cfff4c9/reports/e42fbd93-c568-4118-af41-73bb35425296/overview
Malware family:
Ursnif
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/60494cd9-29ac-4c01-b7fe-2bd9bbe5587b
Result
Threat name:
Ursnif
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/975261
Signature
Found API chain indicative of debugger detection
Found evasive API chain (may stop execution after checking system information)
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Call by Ordinal
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Writes or reads registry keys via WMI
Writes registry values via WMI
Yara detected Ursnif
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 607748 Sample: freeofice.dll Startdate: 12/04/2022 Architecture: WINDOWS Score: 100 62 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->62 64 Found malware configuration 2->64 66 Multi AV Scanner detection for submitted file 2->66 68 3 other signatures 2->68 7 loaddll32.exe 7 2->7         started        11 iexplore.exe 1 53 2->11         started        13 iexplore.exe 1 53 2->13         started        15 2 other processes 2->15 process3 dnsIp4 58 premiumlists.ru 7->58 60 jointoblog.top 7->60 74 Found evasive API chain (may stop execution after checking system information) 7->74 76 Found API chain indicative of debugger detection 7->76 78 Writes or reads registry keys via WMI 7->78 80 Writes registry values via WMI 7->80 17 cmd.exe 1 7->17         started        19 iexplore.exe 31 11->19         started        22 iexplore.exe 32 11->22         started        24 iexplore.exe 13->24         started        26 iexplore.exe 13->26         started        28 iexplore.exe 31 15->28         started        30 iexplore.exe 34 15->30         started        32 iexplore.exe 15->32         started        34 iexplore.exe 15->34         started        signatures5 process6 dnsIp7 36 rundll32.exe 6 17->36         started        40 premiumlists.ru 19->40 42 premiumlists.ru 22->42 44 192.168.2.1 unknown unknown 24->44 46 jointoblog.top 31.41.46.120, 49778, 49779, 49780 ASRELINKRU Russian Federation 28->46 48 62.173.149.135, 49787, 49788, 80 SPACENET-ASInternetServiceProviderRU Russian Federation 30->48 50 linkspremium.ru 32->50 52 linkspremium.ru 34->52 process8 dnsIp9 54 premiumlists.ru 36->54 56 jointoblog.top 36->56 70 System process connects to network (likely due to code injection or exploit) 36->70 72 Writes registry values via WMI 36->72 signatures10
Detection:
isfb
Create hunting rule
Link:
https://mwdb.cert.pl/sample/0a2b10135d3a172952ae033b91474801f0de67c29b2a85dc747417d8da12b853/
Threat name:
Win32.Trojan.Ursnif
Create hunting rule
Status:
Malicious
First seen:
2022-04-12 09:29:52 UTC
File Type:
PE (Dll)
AV detection:
16 of 26 (61.54%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bivrae25hilssuvoam5zcr2iahyn4z6ctmvilxduoql5rwqsxbjq._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
1a16288bf4484b2a6692dcb7244942d7bea94ce3597c175910f91cc2b2613365
Gozi
32c049803e5e151d305c79a1067920a7eaa2dabb92fa7f33ef950097bba016f2
Gozi
7afb35337b5d8c5a6cc2f87d94ddea1a6748bb24fc133e2540f170a0aaf4c219
Gozi
85ef758468c89cd737e77ffafedf036944c74160c4e2200def30c4d9e1fb5108
Gozi
a367e32ce4b41d2a43bbeab5792a4fa2ae51f673d00df6fc73d078c0ed22c68a
Gozi
da266d429a932be228984ed5b0a0b030e5c33493bd6ef6a90bce9502eec38473
Gozi
+ 532 additional samples on MalwareBazaar
Result
Malware family:
gozi_ifsb
Create hunting rule
Score:
  10/10
Tags:
family:gozi_ifsb botnet:7629 banker suricata trojan
Link:
https://tria.ge/reports/220412-ndqy4abaek/
Behaviour
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Gozi, Gozi IFSB
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
Malware Config
C2 Extraction:
jointoblog.top
linkspremium.ru
premiumlists.ru
Unpacked files
SH256 hash:
1a7ba5438b1ee859884273a46185edf54f6401e3093b669d58fe57a243e20bfa
MD5 hash:
0cf87c25e2609f1f7b870ace38fa2cf6
SHA1 hash:
b9cdf6864d6a2dc03c7ef647122e7ba4b288cebd
Detections:
win_isfb_auto
Create hunting rule
Link:
https://www.unpac.me/results/2e18e2ae-f8e5-4da6-b08a-91664608febe/
SH256 hash:
f6b5a117a8f895a56975a33493573003245ef40d7c88dea0e17820f47ae182ef
MD5 hash:
cf8282c2d8ff275b32d11dc695f74711
SHA1 hash:
c69f8bd3b6e566a3ce14834884a8959314831f99
Link:
https://www.unpac.me/results/2e18e2ae-f8e5-4da6-b08a-91664608febe/
SH256 hash:
0a2b10135d3a172952ae033b91474801f0de67c29b2a85dc747417d8da12b853
MD5 hash:
3276454ebcedec7d26569941909ed591
SHA1 hash:
fdb8598e443f640127bd841bc22ee2debd5cc9cf
Link:
https://www.unpac.me/results/2e18e2ae-f8e5-4da6-b08a-91664608febe/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0a2b10135d3a172952ae033b91474801f0de67c29b2a85dc747417d8da12b853

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_isfb_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.isfb.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gozi

DLL dll 0a2b10135d3a172952ae033b91474801f0de67c29b2a85dc747417d8da12b853

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2142531/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/262970/
  
URLhaus
https://urlhaus.abuse.ch/url/2142540/
  
URLhaus
https://urlhaus.abuse.ch/url/2142541/
  
URLhaus
https://urlhaus.abuse.ch/url/2142542/

Comments