MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 57caca34e3b88b43872e32534bccf5292b7c8f8b7569fcae8f49a20a422cf600. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 57caca34e3b88b43872e32534bccf5292b7c8f8b7569fcae8f49a20a422cf600
SHA3-384 hash: 7dcbe21f6aa62577d8da8547e4aa5fce61842c576e958c94bdfe5e029e8858a8f684fa857cf81711f5bcce3a4f974d79
SHA1 hash: 4421a5d300681e56ec9e99fc2f63f36ab98597be
MD5 hash: 504cd296b179deb18a2d776cbbad53c4
humanhash: virginia-moon-butter-winner
File name:d2c0000.dll
Download: download sample
Signature Gozi
Create hunting rule
File size:262'144 bytes
First seen:2022-03-29 12:38:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 6144:1jOc9lLYJm9qCR8h2O1CCP1GzzBpbf7KWtM55QKMu:139VYJj0g2eCCP1GzzT7KWt6
Threatray 30 similar samples on MalwareBazaar
TLSH T16D446D5AA3E50995E9BBC5B9CD93D21BE7F234091A64D34F53B4CE966F03322B21C342
Reporter 0x746f6d6669
Tags:exe Gozi

Intelligence

File Origin
# of uploads :
1
# of downloads :
392
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/259208/
Detection(s):
Win.Malware.Ursnif-9884005-0
Create hunting rule

Win.Malware.Ursnif-9886559-0
Create hunting rule

Win.Malware.Ursnif-9892796-0
Create hunting rule

Win.Malware.Ursnif-9896448-0
Create hunting rule

Win.Malware.Ursnif-9917123-0
Create hunting rule

Win.Malware.Ursnif-9937854-0
Create hunting rule

Win.Malware.GoziISFB-9940853-1
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed setupapi.dll shell32.dll
Link:
https://www.filescan.io/uploads/6242fdeea19c649412a5e098/reports/ee655588-7d46-48bc-955e-3392a200b484/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Ursnif
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c7790108-7795-48bb-a829-e7a7e8090433
Result
Threat name:
Ursnif
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/966696
Signature
Antivirus / Scanner detection for submitted sample
Found malware configuration
Sigma detected: Suspicious Call by Ordinal
Yara detected Ursnif
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 599183 Sample: d2c0000.dll Startdate: 29/03/2022 Architecture: WINDOWS Score: 68 15 Found malware configuration 2->15 17 Antivirus / Scanner detection for submitted sample 2->17 19 Yara detected  Ursnif 2->19 21 Sigma detected: Suspicious Call by Ordinal 2->21 7 loaddll64.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        11 rundll32.exe 7->11         started        process5 13 rundll32.exe 9->13         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/57caca34e3b88b43872e32534bccf5292b7c8f8b7569fcae8f49a20a422cf600/
Threat name:
Win64.Trojan.Ursnif
Create hunting rule
Status:
Malicious
First seen:
2022-03-29 12:39:07 UTC
File Type:
PE+ (Dll)
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
436d6d226550ed2e15292a65859fc41cde7cde6b34e83e10dff0518036cd1787
Gozi
8b5e23b6fec77ca9ef5b22fdbc80ac42d7199c5638b90b45040e0f1038e72b1b
Gozi
aa4fbdc5ce627bba27969922f443d27eb4c3d1937dfb28cc422f9352905ce448
Gozi
b35bf7bd519e05bccf756bf1d1c038837be25283642d6d4d873d7a5820dbeab9
Gozi
bce0ea4a85e5bc6af2dfe91b1ceef3416f210aa4f5c9cf8e6adf1b7f4aacf874
Gozi
cde070a46442e1a06c722393a335e8c104904a0581d890bf25a13f9c0db39473
Gozi
+ 20 additional samples on MalwareBazaar
Result
Malware family:
gozi_ifsb
Create hunting rule
Score:
  10/10
Tags:
family:gozi_ifsb botnet:3000
Link:
https://tria.ge/reports/220329-pvm47sdhc7/
Malware Config
C2 Extraction:
config.edge.skype.com
194.76.226.200
giporedtrip.at
habpfans.at
31.214.157.187
Unpacked files
SH256 hash:
57caca34e3b88b43872e32534bccf5292b7c8f8b7569fcae8f49a20a422cf600
MD5 hash:
504cd296b179deb18a2d776cbbad53c4
SHA1 hash:
4421a5d300681e56ec9e99fc2f63f36ab98597be
Link:
https://www.unpac.me/results/7a396f92-b799-41a9-bb4b-5f734d110779/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/57caca34e3b88b43872e32534bccf5292b7c8f8b7569fcae8f49a20a422cf600

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/259208/

Comments