🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3e61556107cceeff2006d4ba2ab2dc597edd0db7e55b0b2189751d80220e40f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3e61556107cceeff2006d4ba2ab2dc597edd0db7e55b0b2189751d80220e40f9
SHA3-384 hash: e07a030c8c6bc6f56f2baa83d0c37e3f455f2694325cc8a49174bce9e1881fa6b126cd758850f520ee88fa3dfba0dc41
SHA1 hash: ceac76adf0f9e78c1911ec988318e43f0f196c8f
MD5 hash: 6ad5dc964915224942ef4ff6352ff422
humanhash: pluto-golf-mississippi-white
File name:Release.ps1
Download: download sample
Signature Gozi
Create hunting rule
File size:575'023 bytes
First seen:2023-06-06 21:59:20 UTC
Last seen:2023-06-06 23:14:00 UTC
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 12288:PCmm9yftDLcCERVnxAwcxAwcxAwcxAwcxAw3hkrzOo99qkZ:Puy1DmRxi3i3i3i3iiEzOo99qkZ
TLSH T1B4C4124E07364FA8E6CE3D8C14A62A4C07647E32BD70EDD1EC6B70431D676A630DA56B
Reporter proxylife
Tags:5050 Gozi mikehp-com ps1

Intelligence

File Origin
# of uploads :
2
# of downloads :
237
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.JS.Trojan.Cryxos.12167.5349.16020.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
carbanak powershell
Link:
https://www.filescan.io/uploads/647fac637798c0cc4acd52ff/reports/7042a78d-e9dd-4d10-a370-e9e1d45ba66a/overview
Verdict:
Malicious
Labled as:
Trojan.Cryxos.JS
Link:
https://www.hybrid-analysis.com/sample/3e61556107cceeff2006d4ba2ab2dc597edd0db7e55b0b2189751d80220e40f9
Result
Threat name:
n/a
Detection:
clean
Classification:
n/a
Score:
3 / 100
Link:
https://www.joesandbox.com/analysis/1249874
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3e61556107cceeff2006d4ba2ab2dc597edd0db7e55b0b2189751d80220e40f9/
Threat name:
Script-JS.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2023-06-06 22:00:05 UTC
File Type:
Text
AV detection:
8 of 37 (21.62%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hzqvkyihztxp6iag2s5cvmw4lf7n2dnx4vnqwimjouoyaiqoid4q._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/230606-1wmevafh24/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.15
Link:
https://yomi.yoroi.company/submissions/3e61556107cceeff2006d4ba2ab2dc597edd0db7e55b0b2189751d80220e40f9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments