MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2817053b604f2d5f62400afd737d9124c87cc388f76aa10e5cc2db867a31c5dd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2817053b604f2d5f62400afd737d9124c87cc388f76aa10e5cc2db867a31c5dd
SHA3-384 hash: 9480235fb21b05e09137ba8d874957f7ae31bf969d287a43739a79ba817ac25c165d11fce38dda788467291e565a605d
SHA1 hash: ef7c7c2fbf1cd70b83811ce794509f4eb14bf370
MD5 hash: 93b67d2be7ea4060f946c196af2b9f38
humanhash: helium-jupiter-sodium-mockingbird
File name:gg_2.gif.dll
Download: download sample
Signature Gozi
Create hunting rule
File size:103'048 bytes
First seen:2021-04-06 07:28:54 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 811de8e945c2087a6e052096546cd842 (15 x Gozi)
ssdeep 1536:DWKaY5Se9WnVI78XvnoxJasJvRHKmyGDvDk0Rt9Y56l5ZMpvV05o9OX5xPw8:DWa0eQnVI7qCqZGDvDk4wol5w0EU
Threatray 235 similar samples on MalwareBazaar
TLSH CCA3DF00B9DCC4C1D3EA99B049A4DE75350AEDA62834900733F37F6D7EF63A629AB544
Reporter JAMESWT_WT
Tags:dll GG Gozi isfb Ursnif

Intelligence

File Origin
# of uploads :
1
# of downloads :
312
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Ursnif3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/132589/
Detection(s):
SecuriteInfo.com.Mal.EncPk-APW.20791.29558.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Using the Windows Management Instrumentation requests
Launching a process
Creating a window
DNS request
Sending an HTTP GET request
Creating a file
Deleting a recently created file
Searching for the window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Ursnif
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ebf04e61-6b73-46cd-8f90-02fa52bc97ab
Result
Threat name:
Ursnif
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/667243
Signature
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Writes or reads registry keys via WMI
Writes registry values via WMI
Yara detected Ursnif
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 382547 Sample: gg_2.gif.dll Startdate: 06/04/2021 Architecture: WINDOWS Score: 84 33 urs-world.com 2->33 35 prda.aadg.msidentity.com 2->35 37 2 other IPs or domains 2->37 51 Found malware configuration 2->51 53 Multi AV Scanner detection for submitted file 2->53 55 Yara detected  Ursnif 2->55 57 2 other signatures 2->57 8 loaddll32.exe 1 2->8         started        11 iexplore.exe 1 53 2->11         started        13 iexplore.exe 1 50 2->13         started        15 iexplore.exe 1 51 2->15         started        signatures3 process4 signatures5 59 Writes or reads registry keys via WMI 8->59 61 Writes registry values via WMI 8->61 17 rundll32.exe 8->17         started        20 cmd.exe 1 8->20         started        22 iexplore.exe 31 11->22         started        25 iexplore.exe 32 11->25         started        27 iexplore.exe 31 13->27         started        29 iexplore.exe 163 15->29         started        process6 dnsIp7 49 Writes registry values via WMI 17->49 31 rundll32.exe 20->31         started        39 under17.com 185.243.114.196, 80 ACCELERATED-ITDE Netherlands 22->39 41 urs-world.com 185.186.244.95, 80 WEBZILLANL Netherlands 27->41 43 prda.aadg.msidentity.com 29->43 45 login.microsoftonline.com 29->45 47 a.privatelink.msidentity.com 29->47 signatures8 process9
Detection:
isfb
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2817053b604f2d5f62400afd737d9124c87cc388f76aa10e5cc2db867a31c5dd/
Threat name:
Win32.Trojan.Sdum
Create hunting rule
Status:
Malicious
First seen:
2021-04-06 07:29:11 UTC
File Type:
PE (Dll)
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=falqko3aj4wv6ysabl6xg7mretehzq4i65vkcds4ylnym6rryxoq._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
22682ac6f8c484759f44786cc73109993d858a29b25fa1512196154cf2f0299c
Gozi
65179a35467708828de13c9a53f254c956cc4235a0196e3c53ca5022c176a6aa
Gozi
657455d2129ca06ee85cb534186d7d80b648e10f7f9e50f43cc5f56fbc7d154c
Gozi
7af19b7aa91cf1a3fb479f1f352e0a979df69779256653eb1c9961fc9238fb73
Gozi
7d80947ba6784330e792fae5eded56f2e7f228740e19f9af19106886e567b268
Gozi
85d535a2051a60c54a1f2f43ce8854f51a784e87a7a9a5a337567fe3296d81a6
Gozi
8b130f9fbdcfc64e2ef698a1f111409c66aff2ab6ce66ae0286f8c6817376064
Gozi
adc53ae280515df1f79e4c45b0bff1fe484a6994beca972b2a88107c42e21f54
Gozi
d7102c2bee0abe8f04f3faf34374462dbe7b528f3de6492b6e9ce230a5a8d5ef
Gozi
db9ede8dfbecb23b804cd592eeb7500e397ade3bc1fa01551a912ae572cda8b3
Gozi
+ 225 additional samples on MalwareBazaar
Result
Malware family:
gozi_ifsb
Create hunting rule
Score:
  10/10
Tags:
family:gozi_ifsb botnet:5566 banker trojan
Link:
https://tria.ge/reports/210406-jxgw5y7z4x/
Behaviour
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Gozi, Gozi IFSB
Malware Config
C2 Extraction:
bing.com
update4.microsoft.com
under17.com
urs-world.com
Unpacked files
SH256 hash:
063ab0bbf0fb0d410d6cdb708ebf61f0f9aeb95fb475ae2d684fc17fbf9bec73
MD5 hash:
5009f5be4c126c9dd02c3db4a30f6217
SHA1 hash:
c44c5e80c528dae380c93f616818bcaff2a1aaf2
Detections:
win_isfb_auto
Create hunting rule
Link:
https://www.unpac.me/results/abec2619-f7f5-464f-9b4b-c81fb5640ac7/
Parent samples :
eb617fa7cba6309640cda1035eee2fc79fa77c44b229e3c0213d44d97f1b4426
d7102c2bee0abe8f04f3faf34374462dbe7b528f3de6492b6e9ce230a5a8d5ef
2817053b604f2d5f62400afd737d9124c87cc388f76aa10e5cc2db867a31c5dd
SH256 hash:
d8badab2df94fedfa9b7f978add09ff2076fd653f3ebb5152a0bf98bf619ba69
MD5 hash:
e72737e72f201e73b1d8c20ae7d1316b
SHA1 hash:
1ac30858e11cffa7fb5a0cb0d192971e7ef4002b
Detections:
win_isfb_auto
Create hunting rule
Link:
https://www.unpac.me/results/abec2619-f7f5-464f-9b4b-c81fb5640ac7/
Parent samples :
4502918b2eb7a7ff6bc77a2d9878fae3b2389f30124d224ba92958ab13fdf39c
33439b8dfd712e802c8da57016f04842f97047fcb875fa53fb7e34d2e876fc9a
def873123cd2f2a1a2bb661c1ea1986526b86240fb4263e96be6c6a528c02428
eb617fa7cba6309640cda1035eee2fc79fa77c44b229e3c0213d44d97f1b4426
a1600c28548734d79d07a4d91da7e7420da472636a0820764247601f9dd73d5d
7d4aa2b93d2d795cdeca94ae454abbcaffe331583670893076ede4cfb58f5c79
22682ac6f8c484759f44786cc73109993d858a29b25fa1512196154cf2f0299c
d7102c2bee0abe8f04f3faf34374462dbe7b528f3de6492b6e9ce230a5a8d5ef
657455d2129ca06ee85cb534186d7d80b648e10f7f9e50f43cc5f56fbc7d154c
7d80947ba6784330e792fae5eded56f2e7f228740e19f9af19106886e567b268
8b130f9fbdcfc64e2ef698a1f111409c66aff2ab6ce66ae0286f8c6817376064
65179a35467708828de13c9a53f254c956cc4235a0196e3c53ca5022c176a6aa
db9ede8dfbecb23b804cd592eeb7500e397ade3bc1fa01551a912ae572cda8b3
7af19b7aa91cf1a3fb479f1f352e0a979df69779256653eb1c9961fc9238fb73
2817053b604f2d5f62400afd737d9124c87cc388f76aa10e5cc2db867a31c5dd
SH256 hash:
2817053b604f2d5f62400afd737d9124c87cc388f76aa10e5cc2db867a31c5dd
MD5 hash:
93b67d2be7ea4060f946c196af2b9f38
SHA1 hash:
ef7c7c2fbf1cd70b83811ce794509f4eb14bf370
Link:
https://www.unpac.me/results/abec2619-f7f5-464f-9b4b-c81fb5640ac7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2817053b604f2d5f62400afd737d9124c87cc388f76aa10e5cc2db867a31c5dd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ursnif3
Create hunting rule
Author:kevoreilly
Description:Ursnif Payload
Rule name:win_isfb_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/132589/

Comments