🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 440c297bcaa0e4ca3d84281d524b8351ad1ea2b5aabb22795db824a356cd54bd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 440c297bcaa0e4ca3d84281d524b8351ad1ea2b5aabb22795db824a356cd54bd
SHA3-384 hash: 0392d186459b5154131e54f73014718be974d4ec3b9f635967375bb63c34f48f388a94cf087a4171d755bd97de27cb19
SHA1 hash: 21a51f4a3fa0c65509a1c7ef640f7e6b779aee49
MD5 hash: 2f1743897afa6f586ae97f53bf55c14e
humanhash: hot-five-video-bacon
File name:2f1743897afa6f586ae97f53bf55c14e.exe
Download: download sample
Signature Gozi
Create hunting rule
File size:299'520 bytes
First seen:2021-11-23 19:44:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6f82efd43bd3095537b2fbbd588fd6ad (1 x Gozi)
ssdeep 6144:W8wgMcxaKnK1JVhXzHw9SXuZet0ySeznAySUQBs97Tp:W8hMszaPhDQ9SXuZet0ySezaUQB+/p
TLSH T1CA549E00ABA0C839F5B716F889B5D3B9793E7EA16B34A0CB56D416FA06356D0ED30707
File icon (PE):PE icon
dhash icon e8e8e8e8aa66a499 (51 x RaccoonStealer, 27 x ArkeiStealer, 22 x RedLineStealer)
Reporter abuse_ch
Tags:exe Gozi isfb Ursnif

Intelligence

File Origin
# of uploads :
1
# of downloads :
748
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2f1743897afa6f586ae97f53bf55c14e.exe
Verdict:
Malicious activity
Analysis date:
2021-11-23 19:48:12 UTC
Tags:
trojan evasion
Link:
https://app.any.run/tasks/737cde18-00a5-4cee-9916-5e77ce896882

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/619d44c202c80febc2a76465/reports/10f22700-0e00-4ca6-b8cc-61505aadbe42/overview
Malware family:
Ursnif
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e524f6d6-322c-42e3-980e-99c83816864d
Result
Threat name:
Ursnif
Create hunting rule
Detection:
malicious
Classification:
bank.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/895006
Signature
Allocates memory in foreign processes
Changes memory attributes in foreign processes to executable or writable
Creates a thread in another existing process (thread injection)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Disables SPDY (HTTP compression, likely to perform web injects)
Found malware configuration
Hooks registry keys query functions (used to hide registry keys)
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for sample
Maps a DLL or memory area into another process
May check the online IP address of the machine
Modifies the context of a thread in another process (thread injection)
Modifies the export address table of user mode modules (user mode EAT hooks)
Modifies the import address table of user mode modules (user mode IAT hooks)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Self deletion via cmd delete
Sigma detected: Encoded IEX
Sigma detected: MSHTA Spawning Windows Shell
Sigma detected: Powershell run code from registry
Sigma detected: Suspicious Csc.exe Source File Folder
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses nslookup.exe to query domains
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Writes or reads registry keys via WMI
Writes registry values via WMI
Writes to foreign memory regions
Yara detected Ursnif
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 527488 Sample: FpYf5EGDO9.exe Startdate: 23/11/2021 Architecture: WINDOWS Score: 100 87 Found malware configuration 2->87 89 Multi AV Scanner detection for submitted file 2->89 91 Sigma detected: Powershell run code from registry 2->91 93 10 other signatures 2->93 9 FpYf5EGDO9.exe 1 12 2->9         started        13 mshta.exe 19 2->13         started        process3 dnsIp4 79 soderunovos.website 89.44.9.140, 443, 49751, 49753 M247GB Romania 9->79 81 new-fp-shed.wg1.b.yahoo.com 87.248.100.216, 443, 49748 YAHOO-IRDGB United Kingdom 9->81 85 2 other IPs or domains 9->85 113 Detected unpacking (changes PE section rights) 9->113 115 Detected unpacking (overwrites its own PE header) 9->115 117 Writes to foreign memory regions 9->117 121 4 other signatures 9->121 15 control.exe 1 9->15         started        83 192.168.2.1 unknown unknown 13->83 119 Suspicious powershell command line found 13->119 18 powershell.exe 30 13->18         started        signatures5 process6 file7 123 Changes memory attributes in foreign processes to executable or writable 15->123 125 Injects code into the Windows Explorer (explorer.exe) 15->125 127 Writes to foreign memory regions 15->127 129 Allocates memory in foreign processes 15->129 21 explorer.exe 15->21 injected 25 rundll32.exe 15->25         started        61 C:\Users\user\AppData\...\i1aaekli.cmdline, UTF-8 18->61 dropped 131 Modifies the context of a thread in another process (thread injection) 18->131 133 Maps a DLL or memory area into another process 18->133 135 Creates a thread in another existing process (thread injection) 18->135 27 csc.exe 3 18->27         started        30 csc.exe 3 18->30         started        32 conhost.exe 18->32         started        signatures8 process9 dnsIp10 73 lycos.com 21->73 75 ds-ats.member.g02.yahoodns.net 212.82.100.140, 443, 49821 YAHOO-IRDGB United Kingdom 21->75 77 4 other IPs or domains 21->77 103 System process connects to network (likely due to code injection or exploit) 21->103 105 Tries to steal Mail credentials (via file / registry access) 21->105 107 Changes memory attributes in foreign processes to executable or writable 21->107 111 8 other signatures 21->111 34 cmd.exe 21->34         started        37 cmd.exe 21->37         started        39 cmd.exe 21->39         started        45 6 other processes 21->45 63 C:\Users\user\AppData\Local\...\i1aaekli.dll, PE32 27->63 dropped 41 cvtres.exe 1 27->41         started        65 C:\Users\user\AppData\Local\...\4v5gswf4.dll, PE32 30->65 dropped 43 cvtres.exe 30->43         started        file11 109 May check the online IP address of the machine 73->109 signatures12 process13 signatures14 95 Uses ping.exe to sleep 34->95 97 Uses ping.exe to check the status of other devices and networks 34->97 99 Uses nslookup.exe to query domains 34->99 47 conhost.exe 34->47         started        49 PING.EXE 34->49         started        51 nslookup.exe 37->51         started        55 conhost.exe 37->55         started        57 conhost.exe 39->57         started        59 conhost.exe 45->59         started        process15 dnsIp16 67 222.222.67.208.in-addr.arpa 51->67 69 resolver1.opendns.com 51->69 71 myip.opendns.com 51->71 101 May check the online IP address of the machine 51->101 signatures17
Detection:
gozi
Create hunting rule
Link:
https://mwdb.cert.pl/sample/440c297bcaa0e4ca3d84281d524b8351ad1ea2b5aabb22795db824a356cd54bd/
Threat name:
Win32.Trojan.Azorult
Create hunting rule
Status:
Malicious
First seen:
2021-11-23 19:45:09 UTC
File Type:
PE (Exe)
Extracted files:
14
AV detection:
31 of 45 (68.89%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=iqgcs66kudsmupmefaoves4dkgwr5ivvvk5se6k5xaskgvwnks6q._file
Result
Malware family:
gozi_ifsb
Create hunting rule
Score:
  10/10
Tags:
family:gozi_ifsb botnet:4482 banker trojan
Link:
https://tria.ge/reports/211123-ygcwraecd9/
Behaviour
Runs ping.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Gozi, Gozi IFSB
Malware Config
C2 Extraction:
yahoo.com
soderunovos.website
qoderunovos.website
https://soderunovos.website
https://qoderunovos.website
lycos.com
mail.yahoo.com
89.44.9.228
89.44.9.234
89.44.9.166
solerunytol.com
norelimonio.com
doldouletiny.com
Unpacked files
SH256 hash:
06aadb51ac04eda8a617494c70ff1bcd2786b193da4821f09b983a939189db1f
MD5 hash:
5d5a30e513b9a3848cbbd6857a71d90a
SHA1 hash:
a6e99741d5ca29941b1bd99a064034813d49c8f8
Link:
https://www.unpac.me/results/633cec44-eec7-4e85-9c93-2d8fdcf271e0/
SH256 hash:
17797130ef106e4ff3ae555beef7f4bd5ec2c9ee65b2d3a12208a129de10193b
MD5 hash:
8fd5daefb7f64468797d94ffac9c111f
SHA1 hash:
a517026d832f96a39f1939f56c4ceea9072d963e
Detections:
win_isfb_auto
Create hunting rule
Link:
https://www.unpac.me/results/633cec44-eec7-4e85-9c93-2d8fdcf271e0/
Parent samples :
4c50ff0945136ff0f79eb75ee7d5c86025282ab519488f692ffc267873160bb6
440c297bcaa0e4ca3d84281d524b8351ad1ea2b5aabb22795db824a356cd54bd
a548ac73d6acb5a260cb2e1760946c37ce94d89f3cd2a5b126e266e007dfc543
c26838865c476704101363c16c535dfae494dedadae972c0377c4f67669578b5
SH256 hash:
1b54565514d9f960716ed0230dd5c9cba57e52a7af663950e8562acd9255714b
MD5 hash:
47c443d32b78aab61eebb191e8f55e1b
SHA1 hash:
951cc4ef87566794edfc11a0ae7ef63aa8afd04c
Detections:
win_isfb_auto
Create hunting rule
Link:
https://www.unpac.me/results/633cec44-eec7-4e85-9c93-2d8fdcf271e0/
Parent samples :
4c50ff0945136ff0f79eb75ee7d5c86025282ab519488f692ffc267873160bb6
440c297bcaa0e4ca3d84281d524b8351ad1ea2b5aabb22795db824a356cd54bd
a548ac73d6acb5a260cb2e1760946c37ce94d89f3cd2a5b126e266e007dfc543
c26838865c476704101363c16c535dfae494dedadae972c0377c4f67669578b5
SH256 hash:
440c297bcaa0e4ca3d84281d524b8351ad1ea2b5aabb22795db824a356cd54bd
MD5 hash:
2f1743897afa6f586ae97f53bf55c14e
SHA1 hash:
21a51f4a3fa0c65509a1c7ef640f7e6b779aee49
Link:
https://www.unpac.me/results/633cec44-eec7-4e85-9c93-2d8fdcf271e0/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/440c297bcaa0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/440c297bcaa0e4ca3d84281d524b8351ad1ea2b5aabb22795db824a356cd54bd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ursnif3
Create hunting rule
Author:kevoreilly
Description:Ursnif Payload
Rule name:win_isfb_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.isfb.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/208793/

Comments