MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 50810e4696dd075ca23349e3e1c3a87fc7b46ab89f4b1eb093a5cfb74f84cc51. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	50810e4696dd075ca23349e3e1c3a87fc7b46ab89f4b1eb093a5cfb74f84cc51
SHA3-384 hash:	e9d5e5ac2ba47967b3ab735293d33436cf751d5c0ba35c357d8a0f105d1d0d253e842bdb0e5de230871bdc010a54a18e
SHA1 hash:	19307cd55c54e8d4db3666fd11d69f2fe27942c0
MD5 hash:	f6d0b9617405f35bb846d671edda75d3
humanhash:	michigan-solar-tennessee-blue
File name:	dw4qdkjbqwijhdhbwqjid.iso
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	3'023'360 bytes
First seen:	2023-07-12 04:02:26 UTC
Last seen:	2024-09-03 06:50:43 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	d8cf501f2ead6a968abf3df1e5f5d366 (3 x Gozi, 2 x WikiLoader)
ssdeep	49152:jEFD9UfWifI29mfKQnMg2XgEl7MV/yTm:7U9yTm
TLSH	T1D6E54A4562AD84E1E07B90BDD6DFBA1FF5213408071096CB06E44A9D6F33FE94BBA721
TrID	89.2% (.CPL) Windows Control Panel Item (generic) (197083/11/60) 4.7% (.EXE) Win64 Executable (generic) (10523/12/4) 2.2% (.EXE) Win16 NE executable (generic) (5038/12/1) 0.9% (.ICL) Windows Icons Library (generic) (2059/9) 0.9% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter	JAMESWT_WT
Tags:	exe Gozi iso LLC-250215 payload WikiLoader WikiLoaderGozi

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

370

Origin country :

IT

Vendor Threat Intelligence

ANY.RUN

Malware family:

n/a

ID:

1

File name:

dw4qdkjbqwijhdhbwqjid.iso

Verdict:

No threats detected

Analysis date:

2023-07-12 04:03:49 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/fa944192-55f0-4672-bd3b-47b23c05d8cb

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/416184/

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

FileScan.IO No Threat

Verdict:

No Threat

Threat level:

  2/10

Confidence:

100%

Tags:

greyware masquerade

Link:

https://www.filescan.io/uploads/64ae25f76e9f7019de9f6d44/reports/e4558c86-5025-46ce-b502-f9e741811cb4/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/50810e4696dd075ca23349e3e1c3a87fc7b46ab89f4b1eb093a5cfb74f84cc51

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/806bb5e1-46cf-450d-b153-3575239df886

Joe Sandbox clean

Result

Threat name:

n/a

Detection:

clean

Classification:

n/a

Score:

6 / 100

Link:

https://www.joesandbox.com/analysis/1271364

Behaviour

Behavior Graph:

n/a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/50810e4696dd075ca23349e3e1c3a87fc7b46ab89f4b1eb093a5cfb74f84cc51/

ReversingLabs TitaniumCloud Win64.Trojan.Generic

Threat name:

Win64.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-07-12 04:03:05 UTC

File Type:

PE+ (Dll)

AV detection:

4 of 24 (16.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kcaq4ruw3udvzirtjhr6dq5ip7d3i2vyt5fr5metuxh3ot4ezriq._file

Threatray unknown

Verdict:

unknown

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/230712-emccmabg89/

Behaviour

Suspicious use of WriteProcessMemory

Program crash

UnpacMe

Unpacked files

SH256 hash:

50810e4696dd075ca23349e3e1c3a87fc7b46ab89f4b1eb093a5cfb74f84cc51

MD5 hash:

f6d0b9617405f35bb846d671edda75d3

SHA1 hash:

19307cd55c54e8d4db3666fd11d69f2fe27942c0

Link:

https://www.unpac.me/results/7b3faf23-801b-40a4-9856-a7711d3be949/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gozi

exe 50810e4696dd075ca23349e3e1c3a87fc7b46ab89f4b1eb093a5cfb74f84cc51

(this sample)

Cape

https://www.capesandbox.com/analysis/416184/

  

URLhaus

https://urlhaus.abuse.ch/url/2681064/

  

Delivery method

Distributed via web download