🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 67eaada8a12b536d407706e21e7f5b38ccc29d62e40dd66bbf2b2902df0169f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 67eaada8a12b536d407706e21e7f5b38ccc29d62e40dd66bbf2b2902df0169f0
SHA3-384 hash: e36ecae3ba376afdeec7789c96cca7dcd0cc38b4fb18b8bb6020443d4526322ecbbd1e742381a8aa596567c34a8b1210
SHA1 hash: ca6f9879c802bf96697354b01c61e5a98b769275
MD5 hash: e7b4153cc22f46f87835b6d59d6905e4
humanhash: eighteen-speaker-orange-wisconsin
File name:6.bin
Download: download sample
Signature Gozi
Create hunting rule
File size:141'824 bytes
First seen:2021-11-30 13:56:38 UTC
Last seen:2021-11-30 15:33:18 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash db290abd8c8a660aac9a1d7f4707adb4 (2 x Gozi)
ssdeep 1536:j13bU7lD4XoUlo5ukeFgqbOJucsW2EcdNHJV4bJapSQjQhjgkn/ioovJ8nFySRhq:wD4XoL8kFYBNsNeS+wo+cSR8
Threatray 504 similar samples on MalwareBazaar
TLSH T144D3AF01B6C2C079DA7F1A380470A6768B3D7D11DBA0ADDB27D05A390EB42F0ED36D66
Reporter JAMESWT_WT
Tags:brt dll Gozi isfb ITA Ursnif

Intelligence

File Origin
# of uploads :
2
# of downloads :
596
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Ursnif3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/209940/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.26408.3568.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
greyware
Link:
https://www.filescan.io/uploads/61a62db1bbfd2af97cbcad47/reports/e98b02dc-ed24-40a0-8e5c-61a026edf629/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/114d8d87-d5e8-44b2-9076-6ca37395a503
Result
Threat name:
Ursnif
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/898712
Signature
Found malware configuration
Rundll32 performs DNS lookup (likely malicious behavior)
System process connects to network (likely due to code injection or exploit)
Writes or reads registry keys via WMI
Writes registry values via WMI
Yara detected Ursnif
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 531186 Sample: 6.bin Startdate: 30/11/2021 Architecture: WINDOWS Score: 84 28 karfaganda.com 2->28 30 bvolebukoneh.site 2->30 50 Found malware configuration 2->50 52 Yara detected  Ursnif 2->52 8 loaddll32.exe 1 2->8         started        signatures3 process4 dnsIp5 42 karfaganda.com 45.9.20.245, 443, 49926, 49927 DEDIPATH-LLCUS Russian Federation 8->42 44 bvolebukoneh.site 8->44 60 Writes or reads registry keys via WMI 8->60 62 Writes registry values via WMI 8->62 12 cmd.exe 1 8->12         started        14 regsvr32.exe 8->14         started        18 iexplore.exe 1 73 8->18         started        20 3 other processes 8->20 signatures6 process7 dnsIp8 22 rundll32.exe 12->22         started        46 karfaganda.com 14->46 48 bvolebukoneh.site 14->48 64 Writes or reads registry keys via WMI 14->64 66 Writes registry values via WMI 14->66 26 iexplore.exe 2 161 18->26         started        signatures9 process10 dnsIp11 32 karfaganda.com 22->32 34 bvolebukoneh.site 22->34 54 System process connects to network (likely due to code injection or exploit) 22->54 56 Rundll32 performs DNS lookup (likely malicious behavior) 22->56 58 Writes registry values via WMI 22->58 36 ir2-beap.cb.g01.yahoodns.net 212.82.100.169, 443, 49812, 49813 YAHOO-IRDGB United Kingdom 26->36 38 edge.gycpi.b.yahoodns.net 87.248.118.22, 443, 49802, 49803 YAHOO-DEBDE United Kingdom 26->38 40 17 other IPs or domains 26->40 signatures12
Detection:
gozi
Create hunting rule
Link:
https://mwdb.cert.pl/sample/67eaada8a12b536d407706e21e7f5b38ccc29d62e40dd66bbf2b2902df0169f0/
Threat name:
Win32.Trojan.Gozi
Create hunting rule
Status:
Malicious
First seen:
2021-11-30 13:56:48 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
0570fd54d98349e62675cf1e53aa2197ed6c0df811350bfae9f64196b0a49278
Gozi
43440e9a6d2d0a68b84f7885fda26748fa86de6ca709a883959e2640f3f706bf
Gozi
4e7f81fa970f3c2ffa70c22d10b2c81efbf7429594719be49b56a0b516503e4b
Gozi
5bbba6d13c8222ef2cc5c4aecf14043f1e74d164ab2a1b3e4b68ee6cb086900c
Gozi
a6f0ad440063e4aab5a6eab256ead56e4cd9594bc34dcdb273d89dca0f7032d1
Gozi
b82a1d06e5650808ae0b9ef1a77cc6047ca0601b13a9afa8cded17a93e27cda9
Gozi
e5ddae0f09c15a7eaebe71a0ccfcb83ccdd629760b612fffaab46d9a4260e662
Gozi
+ 494 additional samples on MalwareBazaar
Result
Malware family:
gozi_ifsb
Create hunting rule
Score:
  10/10
Tags:
family:gozi_ifsb botnet:8899 banker suricata trojan
Link:
https://tria.ge/reports/211130-q89e2afbbj/
Behaviour
Suspicious use of WriteProcessMemory
Gozi, Gozi IFSB
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
Malware Config
C2 Extraction:
microsoft.com/windowsdisabler
bvolebukoneh.site
karfaganda.com
Unpacked files
SH256 hash:
67eaada8a12b536d407706e21e7f5b38ccc29d62e40dd66bbf2b2902df0169f0
MD5 hash:
e7b4153cc22f46f87835b6d59d6905e4
SHA1 hash:
ca6f9879c802bf96697354b01c61e5a98b769275
Link:
https://www.unpac.me/results/17df8d8c-bb49-43f3-929f-fcfa4b21841f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/67eaada8a12b536d407706e21e7f5b38ccc29d62e40dd66bbf2b2902df0169f0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/209940/

Comments