MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6477f00ecf9e2396faf3ca69abf4d36050f653418fa6877c6f672ea08c4e95c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6477f00ecf9e2396faf3ca69abf4d36050f653418fa6877c6f672ea08c4e95c9
SHA3-384 hash: 28a2fca73100458bd47ba2bfc92ba84a3350a6b18b956235e938e9855b21477dec32523692374808eca2010879dbd8fa
SHA1 hash: 8e858ddba62d6e1dc9bd8dbae3635be5e9c9becd
MD5 hash: cf623936f35a73435798d69f6c35e6b8
humanhash: arkansas-fish-iowa-blue
File name:SecuriteInfo.com.Trojan.Siggen9.46491.9966.26751
Download: download sample
Signature Gozi
Create hunting rule
File size:3'441'152 bytes
First seen:2020-05-19 09:04:43 UTC
Last seen:2020-05-19 09:45:23 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 4cf116229550a15d6e40c5e3e33565e8 (7 x Gozi)
ssdeep 98304:w3stBCQ4uUbYDDhfV3y2YB88QWDyHtGDnfb11W0b2ZhLiUtKLjWU:wctBaUDS2R8JywrbT2ZfOW
Threatray 70 similar samples on MalwareBazaar
TLSH 04F58C017A81E025EAA91AB3CE68D5FD02157D54DF7490DB30D0BF8FBA7BAE69830711
Reporter SecuriteInfoCom
Tags:Gozi

Intelligence

File Origin
# of uploads :
2
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.46491.9966.26751.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Danabot
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 09:35:35 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
1f5b47b9e255b731d6e019429e2b46ef1599fe64dcec7514c74184e9da62aef3
Gozi
361ecee960829c871e1535a6231f3985b2e0b373aecf4bd8d5fea67e1c1834ec
Gozi
504eb3ba676729d316c8f6639ae45b0be030124e0c3007e9edade3b57b49e708
Gozi
7df6cffe72503e47063c3b80da0e2df2d3932fa50cb08daa8f0d0aa8ec7d8184
Gozi
aa85267b21a04aa673ddde02c00feda1b10782b86eaad3ebbe5617a8ad787774
Gozi
c58594d414c882ce33499233c2f508789e5fa4d91b79ef01d763012e39d7b095
Gozi
c8093c755d566699bd222c13ff5b01e952e31a1a2da2f37919550b1c3bd99833
Gozi
e1eabf537423c05f282eba3b0c5bc70931767c23fb9bb2a014999a73e7656e4a
Gozi
e5433fd6cca0e48363d7e1c022becdb8a495290aae3acccac838c2a723394528
Gozi
ec4171872384e62627b06976f6e513650087c00e8c42f70d6b9d29b54e18a8e6
Gozi
+ 60 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-k7v8wdwllx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Blacklisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments