MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e5722af27fc7ae05a9f9705ce1d680fec5fef27a67019c37e2bd768c8e7c07e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5e5722af27fc7ae05a9f9705ce1d680fec5fef27a67019c37e2bd768c8e7c07e
SHA3-384 hash:	c5039b9f6636493a5deea32b50fc278e920f546c48c8e04949042e1564f22a4ec7c0aa6e3f1b867a5ec978d7f9ed78f8
SHA1 hash:	56b2afbc94b67f1c1f5e0a2340e25ca066b9baad
MD5 hash:	22067f54377e90dc3fdd5f384c1fe3ee
humanhash:	sierra-twenty-lemon-lithium
File name:	Invoice_Details.js
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	43'342 bytes
First seen:	2023-07-18 16:31:45 UTC
Last seen:	2023-07-25 08:11:03 UTC
File type:	js
MIME type:	text/plain
ssdeep	384:kac3is6ZeUS1ogXzxmOP0U4OmB/P9rVOKeHBYH8Ffu+wtizOdKUmJYgqEq4SjoaM:/7ylm9FgH1gTP5C1XfW51TJfmh1EE
TLSH	T1B3130C2A766D1311062E56F7FE1A528DE701807C124B06E4323CE79D3B26A1F6BB4EF1
Reporter	proxylife
Tags:	20000 Gozi js Ursnif

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

339

Origin country :

US

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Other.Malware-gen.12365.30736.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

cmd lolbin lolbin masquerade obfuscated replace rundll32

Link:

https://www.filescan.io/uploads/64b6be86f52c3e1a014a436a/reports/10d9b15c-67b8-49d0-9687-a7e9b165eb77/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/5e5722af27fc7ae05a9f9705ce1d680fec5fef27a67019c37e2bd768c8e7c07e

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1275326

Signature

JavaScript source code contains functionality to generate code involving a shell, file or stream

JavaScript source code contains functionality to generate code involving HTTP requests or file downloads

JScript performs obfuscated calls to suspicious functions

Sample has a suspicious name (potential lure to open the executable)

Self deletion via cmd or bat file

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5e5722af27fc7ae05a9f9705ce1d680fec5fef27a67019c37e2bd768c8e7c07e/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lzlsflzh7r5oawu7s4c44hlib7wf73zhuzybtq36fplwrshhyb7a._file

Hatching Triage gozi

Result

Malware family:

gozi

Alert

Create hunting rule

Score:

  10/10

Tags:

family:gozi botnet:20000 banker isfb trojan

Link:

https://tria.ge/reports/230718-t1ykcacc23/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Deletes itself

Executes dropped EXE

Loads dropped DLL

Blocklisted process makes network request

Downloads MZ/PE file

Gozi

Malware Config

C2 Extraction:

http://45.11.182.38
http://79.132.130.230
https://listwhfite.check3.yaho1o.com
https://lisfwhite.ch2eck.yaheoo.com
http://45.155.250.58
https://liset.che3ck.bi1ng.com
http://45.155.249.91

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI ursnif3

Threat name:

ursnif3

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5e5722af27fc7ae05a9f9705ce1d680fec5fef27a67019c37e2bd768c8e7c07e