MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 29c881db1663f14fe1d1df5a996543f178de1ff4aed040d7ebbf4a312e30aa6a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 29c881db1663f14fe1d1df5a996543f178de1ff4aed040d7ebbf4a312e30aa6a
SHA3-384 hash: 0f46260e29e161b75fa111e4f5196d0f1bd08948d6a4f6f7d6b69a02a19a4590cef29d366de04db4b42c1cacb73a8bd2
SHA1 hash: 5f48d4d32b0ed93d323bfe3716b276e25410592c
MD5 hash: 35b2879347efc671c030169106ad138a
humanhash: kentucky-xray-one-washington
File name:SecuriteInfo.com.Variant.Graftor.770268.16575.16012
Download: download sample
Signature Gozi
Create hunting rule
File size:229'888 bytes
First seen:2020-07-21 02:00:15 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 87fc93cb54b57f245d75a270795c77aa (114 x Gozi, 1 x TrickBot)
ssdeep 3072:U6VYA6I0oElwS9ciW+eM+ppv2LHFDp6+7bUSrtB0J3B1rq46vqDyPIKpPLq/M:UWxXElK+Spv2RwSlt6JR1YSDuImq/M
Threatray 720 similar samples on MalwareBazaar
TLSH 76248D0075848039E9BF02364A7ED668467CBD218BA1D9EBB7C84E4F5B390D27B31767
Reporter SecuriteInfoCom
Tags:Gozi

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/29503/
Detection(s):
SecuriteInfo.com.Variant.Graftor.770268.16575.16012.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/392202
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/29c881db1663f14fe1d1df5a996543f178de1ff4aed040d7ebbf4a312e30aa6a/
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 02:02:05 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
icedid
Create hunting rule
gozi
Create hunting rule
Similar samples:
1c69f4b35349402c8ee6ed6e4b7a0cebd93348c8db53ef20f04ac2a734c3cf27
Gozi
2c101fb3e65ba5c467df463b32500e81def730f5d7d0a19b9660a87b20705cc5
Gozi
37163030f966395d482e6842f5546e43068f0fccb3a76990d83500f21079e7aa
Gozi
517801ae25fbba7eecba22323f0375712d0ffe00178a12c983cff0cf28365d73
Gozi
533c458b702921a6c8edb80f1c36591dfae80ccb1af8f63c50b9bbd54ec4dcc8
Gozi
628496d635fe87c7cddfa0f2da7be2678b23a6284a8f7827c9430f398854a03e
Gozi
945e2331307d65f1b8cd9ac1ff030c406a50fade1e86c51a9a915affb389da29
Gozi
ce480c8bdc5f2ae57a1403fc5692e6888c2ebf0c17d396f0ba84b591120ed5df
Gozi
e6ca8c5341cfe074db4dab1efd9363ff1eb5aa5121a790bdea6af79469bff748
Gozi
ed2dcd8cc9b41f4d63001ec4431b8c9e6f617fc2514fc7f8497ec6f23e1834bf
Gozi
+ 710 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/200721-1zltplmjrj/
Behaviour
Modifies system certificate store
Suspicious use of WriteProcessMemory
Suspicious use of WriteProcessMemory
Blacklisted process makes network request
Blacklisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/29c881db1663f14fe1d1df5a996543f178de1ff4aed040d7ebbf4a312e30aa6a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gozi

DLL dll 29c881db1663f14fe1d1df5a996543f178de1ff4aed040d7ebbf4a312e30aa6a

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/29503/
  
URLhaus
https://urlhaus.abuse.ch/url/415634/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/415587/

Comments