🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ac7ce03310cde657eec90facfa67bc6c878a413c462858fc671c1e8acc670f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 13


Intelligence 13 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6ac7ce03310cde657eec90facfa67bc6c878a413c462858fc671c1e8acc670f3
SHA3-384 hash: 1dc1f5145d63cb4397176ddb227a55342af09c80c8ebf5446958863a098c6bcc388cca4dcc81cbfd49db131be530ad73
SHA1 hash: 315a5353b418a066ea5c6c44faf25eac55c81be6
MD5 hash: a79e4eb10421a51f959dbfab392085fa
humanhash: undress-connecticut-papa-lemon
File name:client.exe
Download: download sample
Signature Gozi
Create hunting rule
File size:236'032 bytes
First seen:2023-10-03 06:19:48 UTC
Last seen:2023-10-03 06:38:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b708bc91029a5428d40eddd35d2240ef (7 x Gozi)
ssdeep 3072:JtFok3nTwth5eKvu+95JG3D9TcUonLpq1/xE02WKteBczMCLVIr4upCe7CelPg9:3FjnEtHe8ubzbWdOGWKtNVmX/Zg9
Threatray 636 similar samples on MalwareBazaar
TLSH T16134AE1EB7E29C22E9FF193704269FF64A3DE8258F71981F6354D7740E2A293123C825
TrID 40.3% (.EXE) Win64 Executable (generic) (10523/12/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4505/5/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter JAMESWT_WT
Tags:agenziaentrate exe Gozi isfb Ursnif

Intelligence

File Origin
# of uploads :
2
# of downloads :
396
Origin country :
IT IT
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Fragtor.377438.22645.1831.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Using the Windows Management Instrumentation requests
Gathering data
Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm greyware
Link:
https://www.filescan.io/uploads/651bb29300484a156001223a/reports/47c8bc49-ddce-4dfe-ae02-482464072875/overview
Verdict:
Malicious
Labled as:
TrojanS.F23C58EC
Link:
https://www.hybrid-analysis.com/sample/6ac7ce03310cde657eec90facfa67bc6c878a413c462858fc671c1e8acc670f3
Malware family:
Ursnif
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/25ea8529-c93d-422d-a2eb-531af0f551df
Result
Threat name:
Ursnif
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1318479
Signature
Found API chain indicative of debugger detection
Found evasive API chain (may stop execution after checking system information)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Writes or reads registry keys via WMI
Writes registry values via WMI
Yara detected Ursnif
Behaviour
Behavior Graph:
Download SVG
Detection:
gozi
Create hunting rule
Link:
https://mwdb.cert.pl/sample/6ac7ce03310cde657eec90facfa67bc6c878a413c462858fc671c1e8acc670f3/
Threat name:
Win32.Spyware.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2023-10-03 06:20:06 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
16 of 23 (69.57%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nld44azrbtpgk7xmsd5m7jt3y3ehrjatyrrild6goha6rlggodzq._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
108b8215bfc3a88cf529046b592858d0f80810e76a48b3090d57a73acd3f04f5
Gozi
1c57d98519e5b1381e69949076bd8eefca421b90a51f15220a1092afbc7631b3
Gozi
1e65f7166da4f6fde70acb28b9a9be5471295b28a2e95528472f89166208bcde
Gozi
26dc3b58f57bf1d28e20374fcc13c33f3bc75bd753cf19afb617101f403f7b81
Gozi
3a1211935c4bd148eb6fb23c40d4806ee5a488b09bd61b3c0d15a47dbbfe64fd
Gozi
573ecacb1ccfd4965e899ed3bb811181bf78b62399e10a5690491eb199e0291c
Gozi
64eee9187e295afcb6989200de6fef6ca563d48881784c38765e5cc590e55ad6
Gozi
6b82d78ff4d6f55b4b66ed8410897cec1e845d65ba8f9e77f4f0e4ed499a0d1c
Gozi
bf237f642cd049be1e0be68de0f3bd6ed97be7d05059fb2825f94fd0a5afebfd
Gozi
+ 626 additional samples on MalwareBazaar
Result
Malware family:
gozi
Create hunting rule
Score:
  10/10
Tags:
family:gozi botnet:5050 banker dave isfb trojan
Link:
https://tria.ge/reports/231003-g3rhlagf8v/
Behaviour
Dave packer
Gozi
Malware Config
C2 Extraction:
46.8.210.250
31.41.44.9
185.247.184.139
62.72.33.155
Unpacked files
SH256 hash:
7cba82a63d1bae932c2456250a53fcf70436509f1a90501a34dbfdaf941e9248
MD5 hash:
73f3a6c6abc84f56f1f40d981f3404f0
SHA1 hash:
d96598b72403f6596e397674aeaa7b4f61f0bc93
Link:
https://www.unpac.me/results/e8bda2d3-4f77-4a2b-baba-51d67867bf9b/
SH256 hash:
d795d0781dc3387a557bd4307d14e00a9ae6d9ac4f4dd833abc4bbd390600a46
MD5 hash:
e4d7022dd404d610aed136c89d826e19
SHA1 hash:
7b85aeed0504c0eb2e81ef347b11a0670e6f9001
Detections:
ISFB_Main
Create hunting rule
win_isfb_auto
Create hunting rule
Link:
https://www.unpac.me/results/e8bda2d3-4f77-4a2b-baba-51d67867bf9b/
Parent samples :
6ac7ce03310cde657eec90facfa67bc6c878a413c462858fc671c1e8acc670f3
ba27804848db9f3374c4a16c227d6d6c4259e8eab3a339322e65121a1f688bbc
1a7081393c8f81e484b734028f2ba86cee7f3213fc230be5af38b6e83541892d
c5dd5218b37478426cac0c8a1190967bee9ee752c1c4278611668f9f8a36c0da
31ce7210f050439db9dfb5d7998b1101834c8c7613942a6e73719d6c66bc7e32
6a33b9576d33c195a7b09f9416e5360098f5064ff9ead9a476598cffe1fc1c09
6192a4330bfb0117d71982482bb31f6a04936ad827db57d38b4d52ad3f3d78e1
SH256 hash:
2927bedebee23896be08f2105a0b840a9ece9a6a24c6c44658aa016082226908
MD5 hash:
b4a2e451074a3e5f9937c1cd56f67bc8
SHA1 hash:
62536b1b9e0b56e95f4998bc3b28cfba5771d2d9
Link:
https://www.unpac.me/results/e8bda2d3-4f77-4a2b-baba-51d67867bf9b/
SH256 hash:
6ac7ce03310cde657eec90facfa67bc6c878a413c462858fc671c1e8acc670f3
MD5 hash:
a79e4eb10421a51f959dbfab392085fa
SHA1 hash:
315a5353b418a066ea5c6c44faf25eac55c81be6
Link:
https://www.unpac.me/results/e8bda2d3-4f77-4a2b-baba-51d67867bf9b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6ac7ce03310cde657eec90facfa67bc6c878a413c462858fc671c1e8acc670f3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_indirect_function_call_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_peb_parsing
Create hunting rule
Author:Willi Ballenthin
Rule name:win_isfb_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.isfb.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments