MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0f5c83fb5172a5ea04a023ef355d274f7572e0d294be6f9664d1d3bd8540fdcf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	0f5c83fb5172a5ea04a023ef355d274f7572e0d294be6f9664d1d3bd8540fdcf
SHA3-384 hash:	93b4a9320841fcf2a7e4e58803fd80a3ca14dc95e81a9d7b901a589ce583fee0d6bc36a0b5c8d6c42fca8940e6e9dbe6
SHA1 hash:	7796e4d639823bb80fe94af55abc037c8c06c35c
MD5 hash:	ff02fe5d16d3abcbef7b17ee384e734f
humanhash:	five-item-undress-connecticut
File name:	11_decrypted_dll_from_discord_fixed.dat
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	347'625 bytes
First seen:	2023-07-31 19:34:14 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	ad05ad9e56e1f7f5ae7c2986a290aa6c (1 x Gozi)
ssdeep	6144:yFkcequUUnJqlXp8qm6SUbWNGhw2/K6786TEnCAIpi9MxipEl7BuHBTpOdNPIGA3:wkXG58L6foMbGB
Threatray	581 similar samples on MalwareBazaar
TLSH	T1DE744B91FB665CE2E923437E00D7E36B623DA5804B278F53E764DC324E53EA669C4306
TrID	45.6% (.EXE) InstallShield setup (43053/19/16) 17.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 11.1% (.EXE) Win64 Executable (generic) (10523/12/4) 6.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 5.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):
dhash icon	e0c464dcccc4cc80 (1 x Gozi)
Reporter	Myrtus0x0
Tags:	5050 dll Gozi isfb Ursnif

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

335

Origin country :

US

Vendor Threat Intelligence

CAPE Sandbox UrsnifV3

Detection:

UrsnifV3

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/439475/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Variant.Fragtor.234422.18121.5246.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a window

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-debug anti-vm masquerade overlay packed ryuk

Link:

https://www.filescan.io/uploads/64c80ce92a568ab215b98423/reports/52c5277d-a2a6-4c5e-9984-8f048aff845e/overview

Hybrid Analysis Fragtor.Generic

Verdict:

Malicious

Labled as:

Fragtor.Generic

Link:

https://www.hybrid-analysis.com/sample/0f5c83fb5172a5ea04a023ef355d274f7572e0d294be6f9664d1d3bd8540fdcf

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/e689e7fc-481f-4a34-92a6-37b0d8799033

Joe Sandbox Ursnif

Result

Threat name:

Ursnif

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1283388

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Early bird code injection technique detected

Found API chain indicative of debugger detection

Found evasive API chain (may stop execution after checking system information)

Found malware configuration

Found stalling execution ending in API Sleep call

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queues an APC in another process (thread injection)

Sigma detected: Execute DLL with spoofed extension

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Writes or reads registry keys via WMI

Writes registry values via WMI

Yara detected Ursnif

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB gozi

Detection:

gozi

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/0f5c83fb5172a5ea04a023ef355d274f7572e0d294be6f9664d1d3bd8540fdcf/

ReversingLabs TitaniumCloud Win32.Trojan.Ursnif

Threat name:

Win32.Trojan.Ursnif

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-03-16 17:35:12 UTC

File Type:

PE (Dll)

Extracted files:

4

AV detection:

19 of 38 (50.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=b5oih62roks6ubfaepxtkxjhj52xfygsss7g7fte2hj33bka7xhq._file

Threatray gozi

Verdict:

malicious

Label(s):

gozi

Alert

Create hunting rule

Similar samples:

01b8ce7ce0fef1d9076cee432752d4000661072f8e963676765ef05468f58645

Gozi

0423fd21a639d16d71c50b15fdf96b7e19690583b2aee6f25443329d0e8ea0eb

Gozi

325f7b8b082c01f0b950f001c0bef4d0fc3bb5cef1a8a74bc9dc60be3bdc32e7

Gozi

3ffc3c329ace3bf652db9d8fdcdb7ef19fd1563d39b3ef3934e0170209f03382

Gozi

715cd8f5ce329b92ed0361a50ce7cc90e7b34746380542c040b85d09d3a4fcff

Gozi

f0606eb18477cfec7939d20432ba7999ac9044dfbc936a0071cbe920d02a7e1c

Gozi

+ 571 additional samples on MalwareBazaar

Hatching Triage gozi

Result

Malware family:

gozi

Alert

Create hunting rule

Score:

  10/10

Tags:

family:gozi botnet:5050 banker isfb trojan

Link:

https://tria.ge/reports/230731-yandxaaf54/

Behaviour

Suspicious use of WriteProcessMemory

Gozi

Malware Config

C2 Extraction:

https://config.edge.skype.com
157.254.195.117
91.215.85.172

UnpacMe 3

Unpacked files

SH256 hash:

2de1b7ec1da52f17f07a5e6114a9475f6c786279a916f680607254e88fe9dcc7

MD5 hash:

fb91eae265ed5c366bed72ac9ab9208f

SHA1 hash:

f6dc0d4d348d411a78ac9e291854e199a0de81a2

Link:

https://www.unpac.me/results/9523f1ea-f3f8-4fc2-b125-b84466bd0a8a/

SH256 hash:

cc35132c0a9e258842fc5fcf81f137fe014795f3662d24309e55832b21985a90

MD5 hash:

7ac429af6bc22fada044a86bf8840461

SHA1 hash:

91a329ba71a04bd5250f95f35b1f6cd4713d17d9

Link:

https://www.unpac.me/results/9523f1ea-f3f8-4fc2-b125-b84466bd0a8a/

SH256 hash:

0f5c83fb5172a5ea04a023ef355d274f7572e0d294be6f9664d1d3bd8540fdcf

MD5 hash:

ff02fe5d16d3abcbef7b17ee384e734f

SHA1 hash:

7796e4d639823bb80fe94af55abc037c8c06c35c

Link:

https://www.unpac.me/results/9523f1ea-f3f8-4fc2-b125-b84466bd0a8a/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0f5c83fb5172a5ea04a023ef355d274f7572e0d294be6f9664d1d3bd8540fdcf

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/439475/