MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5831ebc72dc810c036fa0c1dc85e17490ebfe2f7379b9573f99d47817b9eb42c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5831ebc72dc810c036fa0c1dc85e17490ebfe2f7379b9573f99d47817b9eb42c
SHA3-384 hash: 0f6f455efddd615d3dacfc105883a66c3eca11edfa642b3f38e804b06b1e2e3f76fe186de5bd46497cb0804cc262a12e
SHA1 hash: 592380317ff6d62338eeedf0f87b2937316c8e33
MD5 hash: c33644c4f82a0c81ebc17e8c47ff2151
humanhash: kentucky-beryllium-video-three
File name:60daf82a3cb4e.dll
Download: download sample
Signature Gozi
Create hunting rule
File size:368'640 bytes
First seen:2021-06-29 10:40:05 UTC
Last seen:2021-07-14 13:44:52 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 38e6018bca9be3803f6229dc64034399 (1 x Gozi)
ssdeep 6144:hpdZUvvYJLqfQCZU5KgF/LJyAw1cDtmikXX4uBbB:vavYJrzyAMSlkn4u/
Threatray 589 similar samples on MalwareBazaar
TLSH A8746C18B640E434CAF322B74F68D6C5277878A44B708ACF76E86A5F5F794D36230792
Reporter JAMESWT_WT
Tags:brt dll geo Gozi isfb ITA Ursnif

Intelligence

File Origin
# of uploads :
4
# of downloads :
754
Origin country :
n/a
Vendor Threat Intelligence
Detection:
UrsnifV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/168732/
Detection(s):
SecuriteInfo.com.ML.PE-A.28228.12972.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/4de0db75-d2a1-4db6-a6e4-af55d0892986
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/809292
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 441703 Sample: 60daf82a3cb4e.dll Startdate: 29/06/2021 Architecture: WINDOWS Score: 48 19 Multi AV Scanner detection for submitted file 2->19 7 loaddll32.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        11 rundll32.exe 7->11         started        13 rundll32.exe 7->13         started        15 2 other processes 7->15 process5 17 rundll32.exe 9->17         started       
Detection:
gozi
Create hunting rule
Link:
https://mwdb.cert.pl/sample/5831ebc72dc810c036fa0c1dc85e17490ebfe2f7379b9573f99d47817b9eb42c/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lay6xrznzaimanx2bqo4qxqxjehl7yxxg6nzk47ztvdyc646wqwa._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
1a0d4b328438a72cee012f6387825d942463b896fadc13f2c17e8d005f510cd4
Gozi
3b56b7298c366a323d28658a455abf0d4e78fa197a43ce13bedab05f26901d34
Gozi
4bf6e9d4067cb905631ddf7452ac571c4ed9800c7eb8fc7e51b688e1154f52e3
Gozi
821f1b68c207b41e21b519610931ce46719307d99e3e8aeb397ac720d870b476
Gozi
a62876ad5b23476a42760a93bd502ce8d91d86a1fcbfa0f9edc673f4243a08f3
Gozi
af56b9dcb12b4400edbb076430ccf0ecc8c33a1a413a70bdfb1ad7b1cbdf580f
Gozi
bdb26c5860ed5657c9b29eae09079c950159ccc2ebc56f2dffc190d90e33efa4
Gozi
e53caa0529020312a9092b409c2a38d6ddf0c3d2786832a514657ca617df770f
Gozi
e81869620b9a18c3702c7be2fcf2e170cbc5c3de1ddbc84ae1fe190b57e917a0
Gozi
eea88dde6db60a47f8739970d92b729194d2cd6a6d25644a0f26590c2e7097ef
Gozi
+ 579 additional samples on MalwareBazaar
Result
Malware family:
gozi_ifsb
Create hunting rule
Score:
  10/10
Tags:
family:gozi_ifsb botnet:8877 banker trojan
Link:
https://tria.ge/reports/210629-svfpkrd97j/
Behaviour
Suspicious use of WriteProcessMemory
Gozi, Gozi IFSB
Malware Config
C2 Extraction:
outlook.com
ghjakappoppepeodkd.website
hteadclsspdkmdasd.live
Unpacked files
SH256 hash:
81219f549002bea25201e1d37a161337f4b0a0b347f31198179cf0dcddb6c8f4
MD5 hash:
839695024c0d9cb9407fcc52693191b6
SHA1 hash:
e66394211c38836f3aef314299b0768b9ed82f0a
Detections:
win_isfb_auto
Create hunting rule
Link:
https://www.unpac.me/results/76dc9459-7dc8-4595-982a-fd8548972e00/
SH256 hash:
5831ebc72dc810c036fa0c1dc85e17490ebfe2f7379b9573f99d47817b9eb42c
MD5 hash:
c33644c4f82a0c81ebc17e8c47ff2151
SHA1 hash:
592380317ff6d62338eeedf0f87b2937316c8e33
Link:
https://www.unpac.me/results/76dc9459-7dc8-4595-982a-fd8548972e00/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5831ebc72dc810c036fa0c1dc85e17490ebfe2f7379b9573f99d47817b9eb42c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/168732/

Comments