MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 120bb72f63c759f9639de69b6c69ef7044ba8aad6de42d828ad41ce5c9c2c2e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	120bb72f63c759f9639de69b6c69ef7044ba8aad6de42d828ad41ce5c9c2c2e9
SHA3-384 hash:	baa691bf736ab24e2955285cc8e9be3e9a10ff8ccdad01dea56bc6f08295768d674e4d9f5158948041eea59dcc706baf
SHA1 hash:	4b49af83cb30cce8ca6d270b8104c0cbb9ea7d1a
MD5 hash:	47a28863984e5acee7a4aadba0798b81
humanhash:	maryland-bluebird-zulu-may
File name:	server.exe
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	253'952 bytes
First seen:	2023-03-25 07:06:37 UTC
Last seen:	2023-03-26 06:19:16 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	80d951d4a8ff80b46e178f72a4b74c38 (7 x Smoke Loader, 6 x RedLineStealer, 2 x Tofsee)
ssdeep	3072:4jKaOORqiFXz3KcIix5QeiD/XabN9hrbOo52p2pkyr8tYa4PVorWN8aeDr:QzOpum5aCS9hrbOjspffV2va
Threatray	654 similar samples on MalwareBazaar
TLSH	T1D7448E1273E1F964F52687328F1EC6FD663EB8E0DE15BF6E22059A3F0970261C662714
TrID	37.3% (.EXE) Win64 Executable (generic) (10523/12/4) 17.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 16.0% (.EXE) Win32 Executable (generic) (4505/5/1) 7.3% (.ICL) Windows Icons Library (generic) (2059/9) 7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	0894525a90446840 (1 x Gozi)
Reporter	JAMESWT_WT
Tags:	7716 agenziaentrate exe Gozi isfb MEF mise Ursnif

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

309

Origin country :

IT

Vendor Threat Intelligence

ANY.RUN Suspicious

Malware family:

n/a

ID:

1

File name:

server.exe

Verdict:

Suspicious activity

Analysis date:

2023-03-25 07:08:16 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/48357e91-edd6-4dc4-a934-bd16c5e4bead

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox UrsnifV3

Detection:

UrsnifV3

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/377297/

ClamAV Detected

Detection(s):

Win.Ransomware.Tofsee-9994176-0

Alert

Create hunting rule

Win.Ransomware.Tofsee-9994189-0

Alert

Create hunting rule

Win.Ransomware.Tofsee-9994190-0

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Using the Windows Management Instrumentation requests

DNS request

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

80%

Tags:

azorult glupteba greyware lockbit packed

Link:

https://www.filescan.io/uploads/641e9d98d56d0328e7728b6e/reports/a200403a-a4b9-405d-804d-94fa93417774/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/120bb72f63c759f9639de69b6c69ef7044ba8aad6de42d828ad41ce5c9c2c2e9

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Ursnif

Malware family:

Ursnif

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ffe0302a-ea83-4c67-8422-ba8a6304370c

Joe Sandbox Ursnif

Result

Threat name:

Ursnif

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1201749

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found API chain indicative of debugger detection

Found evasive API chain (may stop execution after checking system information)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Writes or reads registry keys via WMI

Writes registry values via WMI

Yara detected Ursnif

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB gozi

Detection:

gozi

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/120bb72f63c759f9639de69b6c69ef7044ba8aad6de42d828ad41ce5c9c2c2e9/

ReversingLabs TitaniumCloud Win32.Trojan.Ursnif

Threat name:

Win32.Trojan.Ursnif

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-03-25 07:07:08 UTC

File Type:

PE (Exe)

Extracted files:

42

AV detection:

23 of 24 (95.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cif3ol3dy5m7sy4542nwy2ppobclvcvnnxsc3auk2qoolsocyluq._file

Threatray gozi

Verdict:

malicious

Label(s):

gozi

Alert

Create hunting rule

Similar samples:

0d6e27d9d750122def144001c6dbb3dda6da964f35df2b634ac8ea7620a3d183

Gozi

93b75a7c9f000e58aa2c13e033e2d822590886ca67e6dc6157c9d5bbe20a6af4

Gozi

9fc2a0858f7a6cc44e72c22d5305fb13dec4c9ff0f78aaf1857c8434abdee2ba

Gozi

bd96620bcaa00e3398c1b7839dc063d56bdbdc1d0390a49efbf70e4569257e28

Gozi

cbf89ed4206fadff9393f1894a454b43b8ea86ede26e4e69943ce60896025665

Gozi

d71eb90b2eafb9a5a0cb8a9294f35c9cb51bb903dc7495a6566e83449503d6b0

Gozi

d766c3ab3c12c580b4bbf32ed2e33d17e7084704a1e61b933ba8e71c95f002dd

Gozi

e29acd346eeb6f9452e6eea2e54f9ac86850ad5b4c9203fd0ff66f29278364e6

Gozi

ec91b5c3178654b86496af10f17af63be1587c13a02f683107f7cec1ed7de0a0

Gozi

fbb595a285f1126d4bfe09240e40b1a8a66ac5024f90b5e64860bb872e05a248

Gozi

+ 644 additional samples on MalwareBazaar

Hatching Triage gozi

Result

Malware family:

gozi

Alert

Create hunting rule

Score:

  10/10

Tags:

family:gozi botnet:7716 banker isfb trojan

Link:

https://tria.ge/reports/230325-hxmswsdg6x/

Behaviour

Gozi

Malware Config

C2 Extraction:

checklist.skype.com
193.233.175.115
185.68.93.20
62.173.140.250
46.8.210.133

UnpacMe ISFB_Main win_isfb_auto

Unpacked files

SH256 hash:

e2689093406a5fb891b62e4ae44d236748b19decf6b760a1e7376d3e67435cc1

MD5 hash:

ee96659569d9fb05d8a57223462436f9

SHA1 hash:

835e0913e03cca2684d656c099ed64279bc00142

Detections:

ISFB_Main

Alert

Create hunting rule

win_isfb_auto

Alert

Create hunting rule

Link:

https://www.unpac.me/results/9ed69a23-bb94-4f8d-a4fb-de4b9417bc5e/

Parent samples :

a5a3fa96916e93c5a31de37ec675878fb192a969dad65e337e68b374db1dce89
9845ab2130e0c1bdad9a5c1b354939481e34b4f06b0391636303c29a24ea3608
9b632250c30411b0d4f0b0a33cd28f5af52a0b5dd4513bdc4a564087fc1e6a43
3abe280839baec9e6aee5759dfbc052688a28237f39532c9e8e419db9c3a0f61
ecfe68b783dbdaddac6583ad328fcffc376ce6d8dfa7a40ed7ff27a5ef65cd4d
7515c850d854d372f10c29229f60c883d1b255236a0abff1031fe331185acb6f
77bba915b59a7d8d5faee3ce608283fe93ab4c2e5b73c5f66bf0e0ecae8c85db
d766c3ab3c12c580b4bbf32ed2e33d17e7084704a1e61b933ba8e71c95f002dd
fbb595a285f1126d4bfe09240e40b1a8a66ac5024f90b5e64860bb872e05a248
d71eb90b2eafb9a5a0cb8a9294f35c9cb51bb903dc7495a6566e83449503d6b0
120bb72f63c759f9639de69b6c69ef7044ba8aad6de42d828ad41ce5c9c2c2e9

SH256 hash:

981447f8c2cadd05bf37818a744cc043580cc9e7fe4a6ee48b9367869270f18f

MD5 hash:

966693dfbf31633ed7539e1c806312ab

SHA1 hash:

78c5735ee6ba5ac5840055d9392b6cf8494975fe

Link:

https://www.unpac.me/results/9ed69a23-bb94-4f8d-a4fb-de4b9417bc5e/

SH256 hash:

120bb72f63c759f9639de69b6c69ef7044ba8aad6de42d828ad41ce5c9c2c2e9

MD5 hash:

47a28863984e5acee7a4aadba0798b81

SHA1 hash:

4b49af83cb30cce8ca6d270b8104c0cbb9ea7d1a

Link:

https://www.unpac.me/results/9ed69a23-bb94-4f8d-a4fb-de4b9417bc5e/

VMRay Ursnif

Malware family:

Ursnif

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/120bb72f63c7/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/120bb72f63c759f9639de69b6c69ef7044ba8aad6de42d828ad41ce5c9c2c2e9

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/377297/