MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 14e041ad11be886018e643ed1cff9abe512e787bec794ab585e75f91e2da119e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gozi

Vendor detections: 14

Intelligence 14 IOCs YARA 1 File information Comments

SHA256 hash:	14e041ad11be886018e643ed1cff9abe512e787bec794ab585e75f91e2da119e
SHA3-384 hash:	0d3fcb6171cea0fd688c61203d75b8e2b16bcb3920cdf68c49623343cda9fa8524d8eff5466371c5012a19ffdd920215
SHA1 hash:	7eea2166bfc6e2b1f99ccc2b43febc110d133c97
MD5 hash:	e2f228a5567d952cb7af6c593509b701
humanhash:	hotel-nebraska-black-bulldog
File name:	e2f228a5567d952cb7af6c593509b701.exe
Download:	download sample
Signature	Gozi Create hunting rule
File size:	297'984 bytes
First seen:	2022-03-09 15:20:10 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	2eebe0dba96971c51a6bd6aeb0592251 (2 x Gozi, 1 x Loki, 1 x ArkeiStealer)
ssdeep	6144:LHKWhw6yLuGepvWoacFScIAHBRi+auJ8b36VjK2880G:jvwFjGvWNciAHXT/82Z7a
Threatray	609 similar samples on MalwareBazaar
TLSH	T1BD548D10BAA0D435F5F316F8597A9378A93E79A09B7490CF52D51AE917386E0FC3130B
File icon (PE):
dhash icon	2dac137839939b91 (18 x RedLineStealer, 12 x Smoke Loader, 6 x Amadey)
Reporter	abuse_ch
Tags:	exe geo Gozi isfb ITA Ursnif

Intelligence

File Origin

# of uploads :

# of downloads :

392

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/248765/

Detection(s):

Win.Dropper.Generickdz-9939781-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Launching a process

Creating a window

Result

Malware family:

n/a

Score:

9/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/8762/overview

Behaviour

MalwareBazaar

CPUID_Instruction

MeasuringTime

SystemUptime

EvasionGetTickCount

EvasionQueryPerformanceCounter

CheckCmdLine

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/6228c5e30cd58dbd926f781c/reports/c4da7300-16af-40ff-8529-131aa2e26fdd/overview

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Ursnif

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/63d9f4a4-a3dc-4a61-8f01-b4e19ff95333

Result

Threat name:

Ursnif

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/953696

Signature

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found API chain indicative of debugger detection

Found evasive API chain (may stop execution after checking system information)

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Writes or reads registry keys via WMI

Writes registry values via WMI

Yara detected Ursnif

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/14e041ad11be886018e643ed1cff9abe512e787bec794ab585e75f91e2da119e/

Threat name:

Win32.Trojan.Ursnif

Status:

Malicious

First seen:

2022-03-09 15:21:08 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

25 of 27 (92.59%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ctqedlirx2egaghgipwrz742xzis46d35r4uvnmf45pzdyw2cgpa._file

Verdict:

malicious

Label(s):

gozi

Gozi

08e7899c7946794dd0b738ff2ac0114efd8f2d3a27dfad22a5bd8fc8603748a6

Gozi

15435517483aae812307904a7564724a17bd74bc10261ad493cbe63677633aa7

Gozi

17dc9a1c147658323ee10781e547fb6a32291d068ced6b0c1372b91e7f8b75c6

Gozi

5ee578d8eb6093a0d276d092a6e431f1a947c3aebf19887cdf1f10f0fdd58982

Gozi

954fdefd2dd5cf44876783f51cf35edef3fb790ed3ba777c1bfafb13680a1ccc

Gozi

9eb0bdb45d505a24290b3fe9adb1ac5c856238e91358fcf7e6af73d9a1b9c244

Gozi

da620c65032d49a148b428dab566fed2a1a9af6fb0f53ffc4ea75ae54a2cd6a9

Gozi

efd04e8f37b1a511e4c723356220d4c07a27a8e8b5a370ea7a7a6b8a5d98ea6b

Gozi

+ 599 additional samples on MalwareBazaar

Result

Malware family:

gozi_ifsb

Score:

10/10

Tags:

family:gozi_ifsb botnet:7622 banker suricata trojan

Link:

https://tria.ge/reports/220309-srbtjscfbn/

Behaviour

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Gozi, Gozi IFSB

suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

Malware Config

C2 Extraction:

botanlink.top
linkspremium.ru
premiumlists.ru

Unpacked files

SH256 hash:

3741ce477a577747dcd6da7a71ae3b5bbe48019b18fb84d2d1aeee0002d9d2d1

MD5 hash:

657b770929aecf3218bb2b9cc801b666

SHA1 hash:

d16f8f83e71a93a061ae4ff3b5e5158959483c60

Detections:

win_isfb_auto

Link:

https://www.unpac.me/results/be24ad2d-2e40-4344-be79-98f14034d3a6/

Parent samples :

efd04e8f37b1a511e4c723356220d4c07a27a8e8b5a370ea7a7a6b8a5d98ea6b
9eb0bdb45d505a24290b3fe9adb1ac5c856238e91358fcf7e6af73d9a1b9c244
da620c65032d49a148b428dab566fed2a1a9af6fb0f53ffc4ea75ae54a2cd6a9
1c6632f98426b86189fde78f0f529fe42eeb2653412b0003090ae6a42c91d268
4bd004047533752383486ead4f6ce67459d38f816d63d110744f0df009b2d022
57d9f65f62b63e02b194c97d66d478f70a75df94abc134d45e02539cbb33d961
14e041ad11be886018e643ed1cff9abe512e787bec794ab585e75f91e2da119e
02f23031b04660ce5d0a3dbd6862640895e37c649963c02d0b367a17d8422ffe
bc2bd3c448b2348629da59a454f409ad5b60f2eb21f175e7e49dd04b2703c0ea
f1d890163f681d1c94337e6459b9c233180ebe755e94095315f7acf0171e1eea
eda3487d5cce3777e504ae88f362c2352de1642fa86200e005ba5a7a3bfbdec0
50ed0329ffb7ae83f7a8042ef7f6bd5af5f308e52f479965358cfe4d646b1847

SH256 hash:

cba3ec7d0bc169ca0ce4a53d8d2ee753354991867fc0264a93639300e4f6f333

MD5 hash:

e7f49957d916e15bf8449f566e9eda8c

SHA1 hash:

391c87ab0dbcc802a8f8d727380caa4c8e9bc781

Detections:

win_isfb_auto

Link:

https://www.unpac.me/results/be24ad2d-2e40-4344-be79-98f14034d3a6/

Parent samples :

SH256 hash:

14e041ad11be886018e643ed1cff9abe512e787bec794ab585e75f91e2da119e

MD5 hash:

e2f228a5567d952cb7af6c593509b701

SHA1 hash:

7eea2166bfc6e2b1f99ccc2b43febc110d133c97

Link:

https://www.unpac.me/results/be24ad2d-2e40-4344-be79-98f14034d3a6/

Malware family:

Ursnif.Dreambot.D

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/14e041ad11be/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/14e041ad11be886018e643ed1cff9abe512e787bec794ab585e75f91e2da119e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.