MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5bbba6d13c8222ef2cc5c4aecf14043f1e74d164ab2a1b3e4b68ee6cb086900c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5bbba6d13c8222ef2cc5c4aecf14043f1e74d164ab2a1b3e4b68ee6cb086900c
SHA3-384 hash: efb88887f5fd4d1eeea3e32f50b2791f21f39dc684a134075cd0913daa532bdde4283feeb5db39832aefa22c15569cce
SHA1 hash: 880a73f218d5b4ba3f734c14ed3b84ef036aa85a
MD5 hash: 096d27e730a16660704e6713fdc89173
humanhash: two-india-lithium-asparagus
File name:096d27e730a16660704e6713fdc89173.dll
Download: download sample
Signature Gozi
Create hunting rule
File size:136'192 bytes
First seen:2021-11-22 13:27:01 UTC
Last seen:2021-11-22 15:49:33 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 4c89e39b5ebc619c69b957c6b4f65780 (6 x Gozi)
ssdeep 3072:wonUFuZWnUWaCezzbqMlJuIqf59+fbbAxSdk6Atue:woU/U3zXdx+eaL7t/
Threatray 496 similar samples on MalwareBazaar
TLSH T1F8D3BE0077D1C474EABF15311474E6B65F6EFD208BD09DEB2B56062A0F30AD0AE36D6A
Reporter abuse_ch
Tags:dll Gozi

Intelligence

File Origin
# of uploads :
2
# of downloads :
333
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.generic.ml.32619.30467.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/619b9aaf94a88037d2fe6776/reports/0ba9fe50-e9b9-4b92-91c6-6139786736db/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Ursnif
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/53ffe470-1316-457f-aa5b-03c54ba1d35a
Result
Threat name:
Ursnif
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/893848
Signature
Found malware configuration
Potentially malicious time measurement code found
Tries to detect virtualization through RDTSC time measurements
Yara detected Ursnif
Behaviour
Behavior Graph:
Download SVG
Detection:
gozi
Create hunting rule
Link:
https://mwdb.cert.pl/sample/5bbba6d13c8222ef2cc5c4aecf14043f1e74d164ab2a1b3e4b68ee6cb086900c/
Threat name:
Win32.Trojan.Gozi
Create hunting rule
Status:
Malicious
First seen:
2021-11-22 13:28:09 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
0570fd54d98349e62675cf1e53aa2197ed6c0df811350bfae9f64196b0a49278
Gozi
210943dc00e09514fe7d9a433596e78a21d7eb3bf3537b7e8327b985c8ad7d4d
Gozi
2f4d76314a00fb7a8047fcdd3ee26c39d2a550cde356d35ae517631392a66e8a
Gozi
43440e9a6d2d0a68b84f7885fda26748fa86de6ca709a883959e2640f3f706bf
Gozi
4ddacac68fd062781fece1e92b3f1682d49fe23fc812e721c330f25237f4c20f
Gozi
a5540f6dd0f7761dd3f7e52f5e1d25332b99d95cccf63401d202406160948750
Gozi
b82a1d06e5650808ae0b9ef1a77cc6047ca0601b13a9afa8cded17a93e27cda9
Gozi
e5ddae0f09c15a7eaebe71a0ccfcb83ccdd629760b612fffaab46d9a4260e662
Gozi
+ 486 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/211122-qp4qfafegm/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
a98563af81949a6f5268994c523cad9c7ef028418e4fc84d446a021382e6e14c
MD5 hash:
cdf3bdc294b699f25b8d6ff8c1a2171e
SHA1 hash:
bd28cb6aa90934cbaf6fd52c68271c4f4fffbb60
Detections:
win_isfb_auto
Create hunting rule
Link:
https://www.unpac.me/results/2c4d718f-90d3-4f2a-9255-6a20b26e14ad/
Parent samples :
e5ddae0f09c15a7eaebe71a0ccfcb83ccdd629760b612fffaab46d9a4260e662
b82a1d06e5650808ae0b9ef1a77cc6047ca0601b13a9afa8cded17a93e27cda9
bce328beb9ae78ec279dc17bf701d58cb1cfa12ff570b00c78c0ada6893c80cf
43440e9a6d2d0a68b84f7885fda26748fa86de6ca709a883959e2640f3f706bf
5bbba6d13c8222ef2cc5c4aecf14043f1e74d164ab2a1b3e4b68ee6cb086900c
450a436cf830b03533a2ce0d8d40724d61c8b0e5f8164413c05d2c870b4ba8eb
SH256 hash:
5bbba6d13c8222ef2cc5c4aecf14043f1e74d164ab2a1b3e4b68ee6cb086900c
MD5 hash:
096d27e730a16660704e6713fdc89173
SHA1 hash:
880a73f218d5b4ba3f734c14ed3b84ef036aa85a
Link:
https://www.unpac.me/results/2c4d718f-90d3-4f2a-9255-6a20b26e14ad/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5bbba6d13c8222ef2cc5c4aecf14043f1e74d164ab2a1b3e4b68ee6cb086900c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gozi

DLL dll 5bbba6d13c8222ef2cc5c4aecf14043f1e74d164ab2a1b3e4b68ee6cb086900c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1804267/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/208178/

Comments