MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 55ba5d8d11fe79f2917dd575334a29b6e2497b2f48c2bba55fe7ab8b192002e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gozi

Vendor detections: 2

Intelligence 2 IOCs YARA 1 File information Comments

SHA256 hash:	55ba5d8d11fe79f2917dd575334a29b6e2497b2f48c2bba55fe7ab8b192002e2
SHA3-384 hash:	ec0e1ad913bab2f7eb9fb72c59c7f7ebc85bea3dfb323c4de62117967b0f8e7e7a4a882fa5e93d18b033759c02ecace5
SHA1 hash:	7997af16d1a0b6d644c6e71bbe45ac1bf5bcf05a
MD5 hash:	6e390c214d9201ad61678b6de6cd5565
humanhash:	hawaii-oxygen-johnny-failed
File name:	Direzione.zip
Download:	download sample
Signature	Gozi Create hunting rule
File size:	5'272 bytes
First seen:	2023-03-01 15:26:10 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
Note:	This file is a password protected archive. The password is: marzo2023
ssdeep	96:Fu5MCnzHw3JPOKB8hOgFfILJUYM0xYsMRdMBHv8CK2ynCxBV72Iw/ZFVd:FurQZWK4OSIOUwRdMBHvtR2CxHk5d
TLSH	T122B17D56356349A1C5090AF1F1DA4F3BFE9E62716C16A99E862D3F0C8F0116B8F04837
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	JAMESWT_WT
Tags:	agenziaentrate Gozi pw-marzo2023 Ursnif zip

Intelligence

File Origin

# of uploads :

# of downloads :

105

Origin country :

File Archive Information

This file is a password protected archive. The password is: marzo2023

This file archive contains 1 file(s), sorted by their relevance:

File name:	Direzione.hta
File size:	7'266 bytes
SHA256 hash:	43f5393a81eeb999ff3d09ddc8289c64046338f4791d004da206fa127ad09ea9
MD5 hash:	5588cf991cebdae3e1b702809ba644ba
MIME type:	application/octet-stream
Signature	Gozi

Vendor Threat Intelligence

Gathering data

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/55ba5d8d11fe79f2917dd575334a29b6e2497b2f48c2bba55fe7ab8b192002e2

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/55ba5d8d11fe79f2917dd575334a29b6e2497b2f48c2bba55fe7ab8b192002e2/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kw5f3dir7z47fel52v2tgsrjw3res6zpjdblxjk746vywgjaalra._file

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://tria.ge/reports/230301-wlbhdagh9v/

Behaviour

Modifies Internet Explorer settings

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.