🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4c2226cf7919ebd40ebdd8944a4793e18790a8e7cd272cb2e1a15d39d1e14df6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4c2226cf7919ebd40ebdd8944a4793e18790a8e7cd272cb2e1a15d39d1e14df6
SHA3-384 hash: 24b0f7eb3dec9150689d867d88333280c6e5c1c375f0eff7f70bdb3e076570dbd3c95c28a051fb3c7b2c6dcacfffb701
SHA1 hash: 91c374339e8ef18a9302a2631b5d070912582d2e
MD5 hash: 02e63fdd95ccad5f6c097a74f558a420
humanhash: table-magnesium-connecticut-pip
File name:0742.js
Download: download sample
Signature Gozi
Create hunting rule
File size:5'013 bytes
First seen:2023-06-08 21:18:56 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 96:5sBeprD12YkUUGsgZislNRGBhWp5quaajeQF+fjsfK0kS6RdX+Y:SBOD1mUUGsBslTGBhU5q3aCQFGsfK0kD
TLSH T191A1E0EB2216F8DD402B8F7288CC564B3014E88BCD679252FA82DF74DC5CC9D468DE69
Reporter proxylife
Tags:555756 Gozi isfb js

Intelligence

File Origin
# of uploads :
1
# of downloads :
319
Origin country :
IE IE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.29506.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
86%
Tags:
cmd evasive obfuscated powershell
Link:
https://www.filescan.io/uploads/648245c86481334efe565591/reports/ae4489c0-9b3e-4c6b-bd17-122d05ba50c8/overview
Verdict:
Suspicious
Labled as:
Trojan.Script.Heuristic
Link:
https://www.hybrid-analysis.com/sample/4c2226cf7919ebd40ebdd8944a4793e18790a8e7cd272cb2e1a15d39d1e14df6
Result
Threat name:
Ursnif
Create hunting rule
Detection:
malicious
Classification:
bank.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1251555
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Bypasses PowerShell execution policy
Changes memory attributes in foreign processes to executable or writable
Creates a thread in another existing process (thread injection)
Disables SPDY (HTTP compression, likely to perform web injects)
Found malware configuration
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Obfuscated command line found
Potential obfuscated javascript found
PowerShell case anomaly found
Powershell drops PE file
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Set custom UserAgent and download file via Powershell
Snort IDS alert for network traffic
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Tries to download and execute files (via powershell)
Tries to steal Mail credentials (via file / registry access)
Writes or reads registry keys via WMI
Writes registry values via WMI
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected Ursnif
Yara detected Obfuscated Powershell
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 884571 Sample: 0742.js Startdate: 08/06/2023 Architecture: WINDOWS Score: 100 68 loggin.biinng.com 2->68 78 Snort IDS alert for network traffic 2->78 80 Found malware configuration 2->80 82 Malicious sample detected (through community Yara rule) 2->82 84 5 other signatures 2->84 10 wscript.exe 1 2->10         started        13 mshta.exe 19 2->13         started        signatures3 process4 signatures5 104 JScript performs obfuscated calls to suspicious functions 10->104 106 Wscript starts Powershell (via cmd or directly) 10->106 108 Obfuscated command line found 10->108 110 2 other signatures 10->110 15 cmd.exe 1 10->15         started        18 control.exe 10->18         started        20 powershell.exe 1 27 13->20         started        process6 file7 120 Suspicious powershell command line found 15->120 122 Wscript starts Powershell (via cmd or directly) 15->122 124 Tries to download and execute files (via powershell) 15->124 140 2 other signatures 15->140 23 1.exe 1 15->23         started        26 powershell.exe 14 26 15->26         started        30 conhost.exe 15->30         started        126 Changes memory attributes in foreign processes to executable or writable 18->126 128 Allocates memory in foreign processes 18->128 130 Maps a DLL or memory area into another process 18->130 32 rundll32.exe 18->32         started        60 C:\Users\user\AppData\...\euo5xsxs.cmdline, Unicode 20->60 dropped 132 Injects code into the Windows Explorer (explorer.exe) 20->132 134 Writes to foreign memory regions 20->134 136 Modifies the context of a thread in another process (thread injection) 20->136 138 Creates a thread in another existing process (thread injection) 20->138 34 explorer.exe 20->34 injected 36 csc.exe 3 20->36         started        38 csc.exe 20->38         started        40 conhost.exe 20->40         started        signatures8 process9 dnsIp10 86 Antivirus detection for dropped file 23->86 88 Writes to foreign memory regions 23->88 90 Allocates memory in foreign processes 23->90 92 Injects a PE file into a foreign processes 23->92 42 RegSvcs.exe 6 23->42         started        70 fuelrescue.ie 185.2.67.20, 443, 49719 BLACKNIGHT-ASIE Ireland 26->70 62 C:\Users\user\AppData\Local\Temp\1.exe, PE32 26->62 dropped 94 Powershell drops PE file 26->94 72 loogin.biinng.com 34->72 96 System process connects to network (likely due to code injection or exploit) 34->96 98 Tries to steal Mail credentials (via file / registry access) 34->98 100 Changes memory attributes in foreign processes to executable or writable 34->100 102 4 other signatures 34->102 46 cmd.exe 34->46         started        48 RuntimeBroker.exe 34->48 injected 50 RuntimeBroker.exe 34->50 injected 56 2 other processes 34->56 64 C:\Users\user\AppData\Local\...\euo5xsxs.dll, PE32 36->64 dropped 52 cvtres.exe 36->52         started        66 C:\Users\user\AppData\Local\...\hgbxgehe.dll, PE32 38->66 dropped 54 cvtres.exe 38->54         started        file11 signatures12 process13 dnsIp14 74 78.153.130.9, 49721, 80 INTERLAN-ASRU Russian Federation 42->74 76 logonn.biinng.com 42->76 112 Writes to foreign memory regions 42->112 114 Allocates memory in foreign processes 42->114 116 Modifies the context of a thread in another process (thread injection) 42->116 118 2 other signatures 42->118 58 conhost.exe 46->58         started        signatures15 process16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4c2226cf7919ebd40ebdd8944a4793e18790a8e7cd272cb2e1a15d39d1e14df6/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jqrcnt3zdhv5idv53ckeur4t4gdzbkhhzutszmxbufottupbjx3a._file
Result
Malware family:
gozi
Create hunting rule
Score:
  10/10
Tags:
family:gozi botnet:555756 banker isfb trojan
Link:
https://tria.ge/reports/230608-z56peaah6x/
Behaviour
Runs ping.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
Blocklisted process makes network request
Gozi
Malware Config
C2 Extraction:
http://logonn.biinng.com
http://78.153.130.9
http://llogiin.biinng.com
http://45.15.157.239
http://loogin.biinng.com
http://loggin.biinng.com
http://dir.biinng.shop
http://log.biinng.cfd
http://sup.biinng.world
Dropper Extraction:
https://fuelrescue.ie/wp/
Malware family:
Ursnif
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4c2226cf7919/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4c2226cf7919ebd40ebdd8944a4793e18790a8e7cd272cb2e1a15d39d1e14df6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments