MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 659812b78542044d9ebb46743ecda037762a71a49f05322d5fa9bd8b3337d0d4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 659812b78542044d9ebb46743ecda037762a71a49f05322d5fa9bd8b3337d0d4
SHA3-384 hash: 1c6637a9b3eea0bcd9e3c85f12e03864faba1c521e35da0ca69cb486dc2fdd28bbdb1dd071649eb54e244f4d3a772f0e
SHA1 hash: 6029e8cb1a5167d2e886e3aea2922d997e3cf11c
MD5 hash: c13fa265ff56bed339c54e428f144f80
humanhash: summer-kitten-aspen-saturn
File name:49988373.dat
Download: download sample
Signature Gozi
Create hunting rule
File size:273'408 bytes
First seen:2020-06-26 08:10:17 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 387759d61d210ffbd079fce3e884be24 (8 x Gozi)
ssdeep 6144:j1IzQHamytE+04hwz4S6Bf9uY+dh+dIvuTVZP+y8:3EP0rz4V1YBKTmy
Threatray 841 similar samples on MalwareBazaar
TLSH FC449D207A97503DF36F9A3D4856C2628D6EBD4296F0BCEB39C10D8F49171D38B60B5A
Reporter JAMESWT_WT
Tags:Gozi

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/14751/
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Delayed writing of the file
Creating a process from a recently created file
Creating a window
Using the Windows Management Instrumentation requests
Launching a service
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/659812b78542044d9ebb46743ecda037762a71a49f05322d5fa9bd8b3337d0d4/
Threat name:
Win32.Worm.Cridex
Create hunting rule
Status:
Malicious
First seen:
2020-06-25 23:26:37 UTC
File Type:
PE (Dll)
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
1bd323c57344a8b38ac22ceec92707ba3b6a30d29b66fc32e163649ea7de8a0f
Gozi
3c7c8fbdd41335948ff0b7e67b905c242865a59c55a4809bf6a5fe4beeee83d9
Gozi
481659d344a246a19eb516b01ea71e074e893f6ab4ba9de11c24fba15a8ec9fc
Gozi
59b5aaa1b9d1225610007636ef70dec8f0f1889661d12690d02494718f7df54b
Gozi
73872d1c97da41772d51fec33613cc1de32b27b43ec5135d1a1c357de5fb9d77
Gozi
8421811ca6b95b3a4f3610184af94f4295a57cc7aaca20062dd42acd76186733
Gozi
8ce9c42220de87bf0dedab305d7874d286726ac18bae834c80e0d6eba8438df7
Gozi
a6c6ab892399b0496ffcd15d3af8dc8840818439367b990f60f51c95c8e56305
Gozi
be14ed801453c78d6c80992705cfe0e7eb03f808d2b28704ffa2925cdc46fdc9
Gozi
fd44086fe5fd433c14f4fc1e03f318353add50ac77dee6da3f64c4d2c5414c1c
Gozi
+ 831 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/200626-2alxs74lze/
Behaviour
Suspicious use of WriteProcessMemory
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://www.malware-traffic-analysis.net/2020/06/24/index.html
Cape
Cape
https://www.capesandbox.com/analysis/14751/

Comments