MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 471325daa2bc75f50856e93e9de088386556fc3ead653894d5c2a67f2a8b4975. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gozi

Vendor detections: 5

Intelligence 5 IOCs YARA 3 File information Comments

SHA256 hash:	471325daa2bc75f50856e93e9de088386556fc3ead653894d5c2a67f2a8b4975
SHA3-384 hash:	5a0ccc16017dc89f743a828e054de09089e04c00bca2d4f299fc7055e53f5c2d29fa8caf325e64d7d9195fa5ed2609eb
SHA1 hash:	281aab2eb26f31cf2255e2f5a467fc5eebda8df8
MD5 hash:	f500854e3cf9556688203a3d869b7d6d
humanhash:	double-fillet-muppet-georgia
File name:	data.bin
Download:	download sample
Signature	Gozi Create hunting rule
File size:	121'856 bytes
First seen:	2020-06-30 05:40:46 UTC
Last seen:	2020-07-01 12:46:41 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	a40e692fc2df9875eb927637f7c2b500 (1 x Gozi)
ssdeep	3072:Z8ypjkWHlpxLzWjY3R6WVYGt5z3sAHcYZi5C7wSyCw7IEFf:WWhzH34WVphiRpE
Threatray	74 similar samples on MalwareBazaar
TLSH	3DC36CE33FC53CF6D6EF063300D5EBFA4AAC65724752BE83A169293855B74C68E56800
Reporter	abuse_ch
Tags:	exe Gozi

Intelligence

File Origin

# of uploads :

# of downloads :

112

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/16775/

Detection(s):

SecuriteInfo.com.ArtemisF500854E3CF9.25697.UNOFFICIAL

Detection:

isfb

Link:

https://mwdb.cert.pl/sample/471325daa2bc75f50856e93e9de088386556fc3ead653894d5c2a67f2a8b4975/

Threat name:

Win32.Trojan.Wacatac

Status:

Malicious

First seen:

2020-06-30 01:41:03 UTC

File Type:

PE (Exe)

AV detection:

21 of 28 (75.00%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=i4jslwvcxr27kccw5e7j3yeihbsvn7b6vvstrfgvykth6kuljf2q._file

Result

Malware family:

n/a

Score:

10/10

Tags:

persistence

Link:

https://tria.ge/reports/200630-m1a6tbcjt2/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Program crash

Enumerates connected drives

Deletes itself

Loads dropped DLL

Executes dropped EXE

Modifies WinLogon for persistence

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Ursnif Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Ursnif(a.k.a. Dreambot, Gozi, ISFB) in memory
Reference:	internal research

Rule name:	win_buer_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

Rule name:	win_isfb_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator