MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 493d258253c3d4b39ae41b07ae583164926731a9d1b17c434cca2b8fa9c80629. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gozi

Vendor detections: 10

Intelligence 10 IOCs YARA 1 File information Comments

SHA256 hash:	493d258253c3d4b39ae41b07ae583164926731a9d1b17c434cca2b8fa9c80629
SHA3-384 hash:	1dca488369b2e46548b1e8cada63ba48fefa54703d04f37c8a4b115caca282ad33cf44509a0f31f5e898cd8bda3e5539
SHA1 hash:	a0b787a519b66cf1c7bd0eeb849d383721ee482a
MD5 hash:	ce9f44b82238ddbcd2c0fefa43b34cbd
humanhash:	ceiling-september-delta-juliet
File name:	miccrosoft_up86472.zip
Download:	download sample
Signature	Gozi Create hunting rule
File size:	242'176 bytes
First seen:	2020-10-08 13:24:25 UTC
Last seen:	2020-10-10 08:06:51 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	8c0da0fc6e703e64ea2ff1df40b7ae41 (1 x Gozi)
ssdeep	3072:hFNm965Y7kuRolQf8zBMsmBrNoWs5s4beqBMgOkXwch4SZjjjjjjj2:QT7eKQmsm3ovsweCMgOkXdhFA
Threatray	1'077 similar samples on MalwareBazaar
TLSH	D1348D20B7E1CD32F1763930789CD6D5B576F80126308D4727A43EAA5E206D11FBBB1A
Reporter	nao_sec
Tags:	FalloutEK Gozi PseudoGate

Intelligence

File Origin

# of uploads :

# of downloads :

248

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Ursnif3

Link:

https://www.capesandbox.com/analysis/69269/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Using the Windows Management Instrumentation requests

Launching a process

Creating a window

DNS request

Connection attempt

Searching for the window

Deleting a recently created file

Result

Threat name:

Ursnif

Detection:

malicious

Classification:

bank.troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/485522

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Creates a COM Internet Explorer object

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to download HTTP data from a sinkholed server

Writes or reads registry keys via WMI

Writes registry values via WMI

Yara detected Ursnif

Behaviour

Behavior Graph:

Download SVG

Detection:

isfb

Link:

https://mwdb.cert.pl/sample/493d258253c3d4b39ae41b07ae583164926731a9d1b17c434cca2b8fa9c80629/

Threat name:

Win32.Backdoor.Tofsee

Status:

Malicious

First seen:

2020-10-08 07:04:00 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

25 of 29 (86.21%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=je6slastypklhgxedmd24wbrmsjgomnj2gyxyq2mzivy7koiayuq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/201008-lzx6b57xe6/

Behaviour

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Unpacked files

SH256 hash:

79b85274b1f2cc79f93ddafebd8d4bb27df4c6b200913e44d1c79d3f3baf1fbe

MD5 hash:

55ab53717724cecce4b354c97daf990b

SHA1 hash:

46b7e031795cb44e6cde727b24fab843de7ccc66

Link:

https://www.unpac.me/results/6a5e9402-b9f3-4d39-8545-0fda77a87a61/

SH256 hash:

f99e510b3d2165031b8864308bba8fbb34996b49ffadd518509afd8a7eeb9544

MD5 hash:

db03e93152d5d0fd8ec77c17cb8231aa

SHA1 hash:

6aa2c86bf16e3670c5ae26409459e3c642a980b3

Detections:

win_isfb_auto

Link:

https://www.unpac.me/results/6a5e9402-b9f3-4d39-8545-0fda77a87a61/

SH256 hash:

493d258253c3d4b39ae41b07ae583164926731a9d1b17c434cca2b8fa9c80629

MD5 hash:

ce9f44b82238ddbcd2c0fefa43b34cbd

SHA1 hash:

a0b787a519b66cf1c7bd0eeb849d383721ee482a

Link:

https://www.unpac.me/results/6a5e9402-b9f3-4d39-8545-0fda77a87a61/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/493d258253c3d4b39ae41b07ae583164926731a9d1b17c434cca2b8fa9c80629

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	win_isfb_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator