MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 681c69db6e33a16845f7ae87d7c0a2a21ee9d5c8313d9e3972de8491aee91511. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 681c69db6e33a16845f7ae87d7c0a2a21ee9d5c8313d9e3972de8491aee91511
SHA3-384 hash: cbcf18e70d5ab81c32d2557eb6d86f8369cf68b88466ae69c3bf9e279647c16524ceaded2f7a5771db3092d049695914
SHA1 hash: 5e4eb400af7131f33ba4a95aba33f06ea769cf55
MD5 hash: 9e616a1757cf1d40689f34d867dd742e
humanhash: gee-mirror-failed-wyoming
File name:SecuriteInfo.com.Win32.GenKryptik.EGOC.27798
Download: download sample
Signature Gozi
Create hunting rule
File size:542'208 bytes
First seen:2020-03-19 01:05:40 UTC
Last seen:2020-03-19 01:30:18 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 26e34cf36a6751e2ee3b24f776d677bf (2 x Gozi)
ssdeep 12288:3MFaRxiRVw4GEBkvkNbBUT29aCBYC8Hc/sdL9nHGqxHZC5g:3Mkxh49kvkNbHCW0d5HG0Ce
TLSH A1B4BF107BA0E036F0F65AB99E76D3B8462D3E909B3480CB31D56EDB52782E69D30717
Reporter SecuriteInfoCom
Tags:Gozi

Intelligence

File Origin
# of uploads :
2
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.GenKryptik.EGOC.27798.UNOFFICIAL
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-03-19 02:04:01 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
25 of 30 (83.33%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/681c69db6e33a16845f7ae87d7c0a2a21ee9d5c8313d9e3972de8491aee91511

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gozi

DLL dll 681c69db6e33a16845f7ae87d7c0a2a21ee9d5c8313d9e3972de8491aee91511

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/326562/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileW
KERNEL32.dll::GetTempPathA

Comments