MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a85735e5412ab19cfcfbe329566e17ae6678dc52ddea44b74e873a6d3f82561. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6a85735e5412ab19cfcfbe329566e17ae6678dc52ddea44b74e873a6d3f82561
SHA3-384 hash: e7f108d7711c88c49ce67f656136a1d6a1188691cfab029c48aa513f24b406677b3138ae857542e8850a8fbdc4f1516c
SHA1 hash: e43a8dde9c99be40a3d3b36ce808609a47cdea80
MD5 hash: e491dd321171338788bba8e441a969ae
humanhash: early-two-stream-chicken
File name:scarica.exe
Download: download sample
Signature Gozi
Create hunting rule
File size:334'336 bytes
First seen:2023-01-23 10:58:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7973a61531c93981746e35cc3b7b0ae0 (4 x TeamBot, 3 x Smoke Loader, 2 x CoinMiner)
ssdeep 6144:SiL9Pf+CZrYdMuvFslwtQK/fu1d0iujmTb:SixPf+0YdzvXtQKXu1C
Threatray 3'586 similar samples on MalwareBazaar
TLSH T15A64AE827AF4AC51D63186718D1BDAEC71ADF8528E19B7372338DA2F2871771C5B3218
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 6c3c2612161484c0 (1 x Gozi)
Reporter JAMESWT_WT
Tags:agenziaentrate exe Gozi Ursnif

Intelligence

File Origin
# of uploads :
1
# of downloads :
239
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
scarica.exe
Verdict:
No threats detected
Analysis date:
2023-01-23 11:00:30 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a093859f-f801-4ccd-8daa-f864f3264cf5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
UrsnifV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/355849/
Detection(s):
Win.Packer.pkr_ce1a-9980177-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm greyware packed
Link:
https://www.filescan.io/uploads/63ce68771c9cbf7d62519fa3/reports/08be4905-5eb2-424f-9181-a6835409df18/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Ursnif
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ec7bc01c-d9a0-4cca-b059-e07921ac49ce
Result
Threat name:
Ursnif
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1156887
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found API chain indicative of debugger detection
Found evasive API chain (may stop execution after checking system information)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Writes or reads registry keys via WMI
Writes registry values via WMI
Yara detected Ursnif
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6a85735e5412ab19cfcfbe329566e17ae6678dc52ddea44b74e873a6d3f82561/
Threat name:
Win32.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2023-01-23 10:58:05 UTC
File Type:
PE (Exe)
Extracted files:
92
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nkcxgxsuckvrtt6pxyzjkzxbpltgpdoffxpkis3u5bz2nu7yevqq._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
235ca5197b7c411b1d21fb3731480c73dedd656445c0deed9a96c7df06190b44
Gozi
2ffe7f10183b4bcb95f2209004f0c68f303151d875a16c9eb0980ae5d717bfd4
Gozi
343edd312c42dc22e7c6529efb3dfeb7acbd6004859672b8920e5203264bc97d
Gozi
39dfc684ee87af0aa4e0fca2a31cb5e7b9d31d7e06794c9875545debdcd68f44
Gozi
5214201099150550c9f3cd7a84ff2398a76f64029af94dc8dcc820439e67f4d0
Gozi
5443f2903d1252e2a212da7614c5388bf2bdbf31d9858dd0d568fb543454a9b7
Gozi
7796075f1ef6325830eed5369b7e5930ca514b6f32d304d51434873fcb5031e0
Gozi
7e3cdf01398c97f906a619d9a8234cb25029084cbc8ff54a927e903df7cf2f9d
Gozi
ee6e6142683852aca599fc3fee8b1cbc31be5d32cb645b4f4f1ee64ed0264f32
Gozi
+ 3'576 additional samples on MalwareBazaar
Result
Malware family:
gozi
Create hunting rule
Score:
  10/10
Tags:
family:gozi botnet:7707 banker isfb trojan
Link:
https://tria.ge/reports/230123-m3dvdsef3t/
Behaviour
Gozi
Malware Config
C2 Extraction:
checklist.skype.com
62.173.149.10
31.41.44.27
193.0.178.235
Unpacked files
SH256 hash:
05d1e45c65cc53e935153e6278089cb228cceffbcdc65067c30273265bc2ce9c
MD5 hash:
6bddc7ac5daf41b61eb3641d804f49eb
SHA1 hash:
6499cffa7ffdd633390c99f5c41df3c96d62f34e
Detections:
ISFB_Main
Create hunting rule
win_isfb_auto
Create hunting rule
Link:
https://www.unpac.me/results/146be8b8-2151-4612-a005-7f72184f1982/
Parent samples :
7796075f1ef6325830eed5369b7e5930ca514b6f32d304d51434873fcb5031e0
6a85735e5412ab19cfcfbe329566e17ae6678dc52ddea44b74e873a6d3f82561
8b154b06cc094eb22a4aae98f2bc60e4759f6258aa5bfb364f44b665bf65ff1e
a0582f1620e556673fb326be7c5861dc418a91877db39699c62d56edf0066296
8f97d27f6865a095851353708666db5b68d831cc4e6251089d236a58f89a2aaf
7795986ba1469a24229fa4677c86267d2ea81f7309bf2b037f41986f9de33e95
43c74657d446c3b7867dde69f79b4839927c9cc10a421798969c433dd8dde174
05d1e45c65cc53e935153e6278089cb228cceffbcdc65067c30273265bc2ce9c
SH256 hash:
2d5307ceb90e53fb4aa419cad94286cf972f1f907efcf05d8e025b1cf1d423d2
MD5 hash:
7ec2a06328e521228c774ea354abf7a2
SHA1 hash:
637ae913484853bd1312bd94dc97123f45f1ab00
Link:
https://www.unpac.me/results/146be8b8-2151-4612-a005-7f72184f1982/
SH256 hash:
6a85735e5412ab19cfcfbe329566e17ae6678dc52ddea44b74e873a6d3f82561
MD5 hash:
e491dd321171338788bba8e441a969ae
SHA1 hash:
e43a8dde9c99be40a3d3b36ce808609a47cdea80
Link:
https://www.unpac.me/results/146be8b8-2151-4612-a005-7f72184f1982/
Malware family:
Ursnif
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6a85735e5412/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6a85735e5412ab19cfcfbe329566e17ae6678dc52ddea44b74e873a6d3f82561

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security
Rule name:win_isfb_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.isfb.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/355849/

Comments