🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41f5338ab7665fd97eee000f1e121c7638913b5f0686e43121cc2c28e6b0ade3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 41f5338ab7665fd97eee000f1e121c7638913b5f0686e43121cc2c28e6b0ade3
SHA3-384 hash: f6e255a7d1304aebbe4ec775698b8747b148bad860ce696e1545bd7992d94fb849c5912d217b3949221fce0eafb9f935
SHA1 hash: 7bcacdbee55c3eea556d2aa79f04377344a54e47
MD5 hash: e0b8b9c15f6c0b1388373e3e91942d8d
humanhash: harry-wolfram-neptune-washington
File name:0a3c77e52c0da67447dc36f7326a5334089b557a13504c43d4cf07f8b3526d1c.exe
Download: download sample
Signature Gozi
Create hunting rule
File size:9'899'008 bytes
First seen:2024-08-31 20:43:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c1fbf380722f62e9d13f77bc10915a89 (1 x Gozi)
ssdeep 98304:udv7AIFM+IJkXHJKZno3XzJ9ktJUs71Saxfz7w3YV:gEIFM+IGXHo+TJ9EBz7w3YV
TLSH T1AFA63323F64E87E8C48662F1E441A225CAEF40807BFA06116B5B974C31D7DAA13F73E5
TrID 38.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.6% (.ICL) Windows Icons Library (generic) (2059/9)
15.4% (.EXE) OS/2 Executable (generic) (2029/13)
15.2% (.EXE) Generic Win/DOS Executable (2002/3)
15.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter Anonymous
Tags:exe Gozi

Intelligence

File Origin
# of uploads :
1
# of downloads :
511
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
0a3c77e52c0da67447dc36f7326a5334089b557a13504c43d4cf07f8b3526d1c.exe
Verdict:
No threats detected
Analysis date:
2024-08-31 20:44:46 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/8a0a9f4d-caba-4451-8756-45b8cfc5fad3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.Win64.Enigma.20248.29685.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
84.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66d38097ad7abf2db5cfae88
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
Using the Windows Management Instrumentation requests
Searching for the window
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
enigma obsidium overlay packed packed
Link:
https://www.filescan.io/uploads/66d3809378130acf33ab0847/reports/ff34e273-8182-4309-b537-838d1ce77930/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/41f5338ab7665fd97eee000f1e121c7638913b5f0686e43121cc2c28e6b0ade3
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/5b6021d1-785c-46d7-9b3e-153a35ee5177
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1502283
Signature
AI detected suspicious sample
Contain functionality to detect virtual machines
Contains functionality to infect the boot sector
Contains functionality to inject code into remote processes
Detected unpacking (changes PE section rights)
Found direct / indirect Syscall (likely to bypass EDR)
Found evasive API chain (may stop execution after checking mutex)
Hides threads from debuggers
Machine Learning detection for sample
PE file has nameless sections
Query firmware table information (likely to detect VMs)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Behaviour
Behavior Graph:
Download SVG
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/41f5338ab7665fd97eee000f1e121c7638913b5f0686e43121cc2c28e6b0ade3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/41f5338ab7665fd97eee000f1e121c7638913b5f0686e43121cc2c28e6b0ade3/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ih2thcvxmzp5s7xoaahr4eq4oy4jco27a2doimjbzqwcrzvqvxrq._file
Verdict:
malicious
Result
Malware family:
gozi
Create hunting rule
Score:
  10/10
Tags:
family:gozi banker isfb trojan
Link:
https://tria.ge/reports/240831-zh5htsvbll/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of NtSetInformationThreadHideFromDebugger
Gozi
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/794ac2c6-4679-4270-910b-ae0a55bba276
Unpacked files
SH256 hash:
41f5338ab7665fd97eee000f1e121c7638913b5f0686e43121cc2c28e6b0ade3
MD5 hash:
e0b8b9c15f6c0b1388373e3e91942d8d
SHA1 hash:
7bcacdbee55c3eea556d2aa79f04377344a54e47
Link:
https://www.unpac.me/results/cb04537e-314e-4d0e-8dbf-d078b59e0f5c/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/41f5338ab766/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/41f5338ab7665fd97eee000f1e121c7638913b5f0686e43121cc2c28e6b0ade3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_detect_tls_callbacks
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (NX_COMPAT)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
Reviews
IDCapabilitiesEvidence
SHELL_APIManipulates System Shellshell32.dll::ShellExecuteA
WIN32_PROCESS_APICan Create Process and ThreadsWININET.dll::InternetCloseHandle
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryA
WIN_BASE_IO_APICan Create Filesversion.dll::GetFileVersionInfoA

Comments