MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1056ea3dad265dd554362bc0bd67f08fa2b9f3e5839e6e4fb197831a15c8acef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	1056ea3dad265dd554362bc0bd67f08fa2b9f3e5839e6e4fb197831a15c8acef
SHA3-384 hash:	02f6b60a9e83afad8c461b5989e49b65b6f6528bc44ba081011a097b691eb8123d2ac4d8dd05b280722e3a8aa16e1e7c
SHA1 hash:	1bc85809ddd4411897232c691a2c866f5db67175
MD5 hash:	ae3d7de4671718a92cdceae507d9c5e2
humanhash:	montana-connecticut-delaware-carolina
File name:	d2ef5.exe
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	37'888 bytes
First seen:	2023-02-18 20:13:42 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	1640d668d1471f340cbe565fe63522f6 (15 x Gozi)
ssdeep	768:eQLm41fM01vAPyRPq63goMWPXE2bE/JVMq2LATqeeAeOu2D2wqmLiuMPc:eL41fMSvGAPqlaPGhVMq2LpeReOb2Pmi
Threatray	2'500 similar samples on MalwareBazaar
TLSH	T12B03D0AA6BA048B6C6D39335362966C4DF481732423558E0E7B749398B92C8FD56F313
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	luc4m
Tags:	exe Gozi isfb Ursnif

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

294

Origin country :

IT

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

d2ef5.exe

Verdict:

Malicious activity

Analysis date:

2023-02-18 20:14:07 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/cf834221-2da5-4951-9c98-5d16cdd859ad

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox UrsnifV3

Detection:

UrsnifV3

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/368155/

ClamAV Detected

Detection(s):

Win.Packed.Zusy-9980023-0

Alert

Create hunting rule

Win.Malware.GoziISFB-9940853-2

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Using the Windows Management Instrumentation requests

Certego Dragonfly Suspicious

Result

Malware family:

n/a

Score:

  5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/71667/overview

Behaviour

MalwareBazaar

CheckCmdLine

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

gozi packed

Link:

https://www.filescan.io/uploads/63f1318ac0c2113f82dabdfe/reports/f8bdbb7f-6726-466a-adcd-f08fd3e61e55/overview

Hybrid Analysis Zusy.Generic

Verdict:

Malicious

Labled as:

Zusy.Generic

Link:

https://www.hybrid-analysis.com/sample/1056ea3dad265dd554362bc0bd67f08fa2b9f3e5839e6e4fb197831a15c8acef

Intezer Ursnif

Malware family:

Ursnif

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c5f01af8-ba38-48d3-be85-8632a54cca9d

Joe Sandbox Ursnif

Result

Threat name:

Ursnif

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1178713

Signature

Antivirus / Scanner detection for submitted sample

Found API chain indicative of debugger detection

Found evasive API chain (may stop execution after checking system information)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Writes or reads registry keys via WMI

Writes registry values via WMI

Yara detected Ursnif

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB gozi

Detection:

gozi

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/1056ea3dad265dd554362bc0bd67f08fa2b9f3e5839e6e4fb197831a15c8acef/

ReversingLabs TitaniumCloud Win32.Trojan.Ursnif

Threat name:

Win32.Trojan.Ursnif

Alert

Create hunting rule

Status:

Malicious

First seen:

2022-09-19 23:42:29 UTC

File Type:

PE (Exe)

AV detection:

33 of 39 (84.62%)

Threat level:

  5/5

Spamhaus Hash Blocklist

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=cbloupnnezo5kvbwfpal2z7qr6rlt47fqopg4t5rs6brufoivtxq._file

Threatray gozi

Verdict:

malicious

Label(s):

gozi

Alert

Create hunting rule

Similar samples:

13d8b891a0f9c00af8c624a5bfd24f42d15fba3e19225d29b9af39cd9f8cea03

Gozi

79591b44955812c9f6c9f6d168a927c7af1bea5928d22c1d210eddbbcd93578e

Gozi

950ae733089e9761c22fcd9b1f5c1a45357fb744667298070da464afaa560905

Gozi

a06010d09b93b8cf46c397a30a15e7f4a163fddd7eaa18dc0eeb202b9f2560a5

Gozi

b75c337a0fb7eb49ec34d6d313a612e93dc4180a8bf25f99fd7b10ea1077e8e1

Gozi

b968be42546794effa6900666e9e6ad09c6e211d192571a1bed308c92222c227

Gozi

bf0dae2bf317f6fd26f8815792aa685671842fa9393cef61c394b37ff552595d

Gozi

c765e040e1facf4b651d4684a4fdb3fd04c0d01e506bfb0dce454104f2c43f8c

Gozi

+ 2'490 additional samples on MalwareBazaar

Hatching Triage gozi

Result

Malware family:

gozi

Alert

Create hunting rule

Score:

  10/10

Tags:

family:gozi botnet:10101 banker isfb trojan

Link:

https://tria.ge/reports/230218-yzy7pscf9y/

Behaviour

Gozi

Malware Config

C2 Extraction:

trackingg-protectioon.cdn1.mozilla.net
45.8.158.104
188.127.224.114
weiqeqwns.com
wdeiqeqwns.com
weiqeqwens.com
weiqewqwns.com
iujdhsndjfks.com

UnpacMe ISFB_Main win_isfb_auto

Unpacked files

SH256 hash:

876201dcb9444bc250f944dc23076acf45f1c3924d5f68a2ea818473735d6b2b

MD5 hash:

2ed828a72d278a034c866530aad4e2d3

SHA1 hash:

d22d72321e416fb19c06ca254d9fca9c0390c2f0

Detections:

ISFB_Main

Alert

Create hunting rule

win_isfb_auto

Alert

Create hunting rule

Link:

https://www.unpac.me/results/47d46701-aef1-4c07-88c3-91f86b7401ce/

SH256 hash:

1056ea3dad265dd554362bc0bd67f08fa2b9f3e5839e6e4fb197831a15c8acef

MD5 hash:

ae3d7de4671718a92cdceae507d9c5e2

SHA1 hash:

1bc85809ddd4411897232c691a2c866f5db67175

Link:

https://www.unpac.me/results/47d46701-aef1-4c07-88c3-91f86b7401ce/

VMRay Ursnif

Malware family:

Ursnif

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/1056ea3dad26/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.34

Link:

https://yomi.yoroi.company/submissions/1056ea3dad265dd554362bc0bd67f08fa2b9f3e5839e6e4fb197831a15c8acef

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Gozi

exe 1056ea3dad265dd554362bc0bd67f08fa2b9f3e5839e6e4fb197831a15c8acef

(this sample)

  

X

https://twitter.com/1ZRR4H/status/1575364116356775941

  

Dropped by

Malsmoke

  

Dropped by

BatLoader

  

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/368155/