🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b722961edc010c5487de4ef7eee84b586ac3c3f06dbd1920935ea5f7bb90543. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 13


Intelligence 13 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6b722961edc010c5487de4ef7eee84b586ac3c3f06dbd1920935ea5f7bb90543
SHA3-384 hash: e2561b6d602c48000d59c5fe51d07e87f5ba14c4101191f5f8cb2909f03e64374f15f1c0d5a23d062ed631f36ffb43d9
SHA1 hash: 90522132e3a97e966e5270a8e105cc33f0d6c4e5
MD5 hash: 3b892bea0f8cbe0b61ee380743567d1d
humanhash: oven-november-quiet-august
File name:Lx6.exe
Download: download sample
Signature Gozi
Create hunting rule
File size:38'400 bytes
First seen:2022-10-11 12:48:23 UTC
Last seen:2023-08-27 08:54:49 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a225a198dd77b77924eb15a705beb665 (16 x Gozi)
ssdeep 768:Z41V8UHIm2wyBdcNtW2RTYBfx6w39rDE3Lkjx2K/ZK38ua:ZefIZwAdeD8B56w39HE384h38
Threatray 168 similar samples on MalwareBazaar
TLSH T1F103F1A418107CBFDF2FE13B6315E11EA5B583C1150B0EC9E274E6DDE276422EA5C28E
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter 0xToxin
Tags:185.212.47.133 194.76.225.60 91.213.50.74 exe Gozi tel12-msn-com


Avatar
0xToxin
rev + b64 txt files:
http://91.213.50.74/new/mofers/

Intelligence

File Origin
# of uploads :
7
# of downloads :
290
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/318950/
Detection(s):
Win.Malware.GoziISFB-9940853-1
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Using the Windows Management Instrumentation requests
Sending an HTTP GET request
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/42504/overview
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6345663f316b332dfca8cbdb/reports/3a55050d-1c2f-4791-b9dc-5084a312b799/overview
Malware family:
Ursnif
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fe6f4f8b-e3b8-4096-b5d1-62b9ce230b67
Result
Threat name:
Ursnif
Create hunting rule
Detection:
malicious
Classification:
spre.bank.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1087993
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Changes memory attributes in foreign processes to executable or writable
Creates a thread in another existing process (thread injection)
Disables SPDY (HTTP compression, likely to perform web injects)
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs a network lookup / discovery via net view
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Self deletion via cmd or bat file
Sigma detected: Dot net compiler compiles file from suspicious location
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses net.exe to modify the status of services
Uses nslookup.exe to query domains
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Writes or reads registry keys via WMI
Writes registry values via WMI
Writes to foreign memory regions
Yara detected Ursnif
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 720586 Sample: Lx6.exe Startdate: 11/10/2022 Architecture: WINDOWS Score: 100 119 Snort IDS alert for network traffic 2->119 121 Malicious sample detected (through community Yara rule) 2->121 123 Antivirus / Scanner detection for submitted sample 2->123 125 4 other signatures 2->125 11 mshta.exe 19 2->11         started        13 Lx6.exe 1 12 2->13         started        process3 dnsIp4 17 powershell.exe 28 11->17         started        99 194.76.225.60, 49700, 80 RACKPLACEDE Germany 13->99 101 www.msn.com 13->101 103 3 other IPs or domains 13->103 169 Writes to foreign memory regions 13->169 171 Writes or reads registry keys via WMI 13->171 173 Writes registry values via WMI 13->173 21 control.exe 1 13->21         started        signatures5 process6 file7 83 C:\Users\user\AppData\...\iyr5jfx4.cmdline, Unicode 17->83 dropped 127 Injects code into the Windows Explorer (explorer.exe) 17->127 129 Writes to foreign memory regions 17->129 131 Modifies the context of a thread in another process (thread injection) 17->131 133 2 other signatures 17->133 23 explorer.exe 5 20 17->23 injected 27 conhost.exe 17->27         started        29 csc.exe 3 17->29         started        32 csc.exe 3 17->32         started        34 rundll32.exe 21->34         started        signatures8 process9 dnsIp10 93 194.76.225.61, 49703, 80 RACKPLACEDE Germany 23->93 95 a-0003.a-msedge.net 204.79.197.203, 49702, 80 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 23->95 97 5 other IPs or domains 23->97 159 System process connects to network (likely due to code injection or exploit) 23->159 161 Tries to steal Mail credentials (via file / registry access) 23->161 163 Changes memory attributes in foreign processes to executable or writable 23->163 167 8 other signatures 23->167 36 cmd.exe 23->36         started        39 cmd.exe 23->39         started        41 cmd.exe 23->41         started        47 26 other processes 23->47 165 Writes registry values via WMI 27->165 89 C:\Users\user\AppData\Local\...\iyr5jfx4.dll, PE32 29->89 dropped 43 cvtres.exe 1 29->43         started        91 C:\Users\user\AppData\Local\...\jxpjpfgv.dll, PE32 32->91 dropped 45 cvtres.exe 1 32->45         started        file11 signatures12 process13 signatures14 135 Writes to foreign memory regions 36->135 137 Modifies the context of a thread in another process (thread injection) 36->137 139 Maps a DLL or memory area into another process 36->139 49 powershell.exe 36->49         started        52 conhost.exe 36->52         started        141 Uses ping.exe to sleep 39->141 143 Uses ping.exe to check the status of other devices and networks 39->143 145 Uses nslookup.exe to query domains 39->145 147 Uses net.exe to modify the status of services 39->147 54 conhost.exe 39->54         started        56 PING.EXE 39->56         started        58 systeminfo.exe 41->58         started        60 conhost.exe 41->60         started        149 Performs a network lookup / discovery via net view 47->149 62 nslookup.exe 47->62         started        65 net.exe 47->65         started        67 31 other processes 47->67 process15 dnsIp16 109 Writes to foreign memory regions 49->109 111 Modifies the context of a thread in another process (thread injection) 49->111 113 Maps a DLL or memory area into another process 49->113 69 csc.exe 49->69         started        73 csc.exe 49->73         started        75 conhost.exe 49->75         started        115 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 58->115 117 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 58->117 105 8.8.8.8.in-addr.arpa 62->105 107 1.0.0.127.in-addr.arpa 62->107 77 net1.exe 65->77         started        signatures17 process18 file19 85 C:\Users\user\AppData\Local\...\msihj3zd.dll, PE32 69->85 dropped 151 Writes to foreign memory regions 69->151 153 Allocates memory in foreign processes 69->153 155 Modifies the context of a thread in another process (thread injection) 69->155 79 cvtres.exe 69->79         started        87 C:\Users\user\AppData\Local\...\vupj0yhs.dll, PE32 73->87 dropped 157 Maps a DLL or memory area into another process 73->157 81 cvtres.exe 73->81         started        signatures20 process21
Detection:
isfb
Create hunting rule
Link:
https://mwdb.cert.pl/sample/6b722961edc010c5487de4ef7eee84b586ac3c3f06dbd1920935ea5f7bb90543/
Threat name:
Win32.Infostealer.Gozi
Create hunting rule
Status:
Malicious
First seen:
2022-10-11 00:07:51 UTC
File Type:
PE (Exe)
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nnzcsypnyaimksd54txx53uewwdkypb7a3n5deqjgxvf665zavbq._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
2db38485abff68002fced62495b105cf98ca3eda7bbd30249ed3cf8be23ff2e0
Gozi
7ca57c7d182c4c00ae2c86e0e2055734d6b6421a7c419b5bb9c69869b8dbec64
Gozi
8a7f259ecd7479314c5bd6e449a7b77f76173d4e636075f99a0b8eb765d3573a
Gozi
8e570e32acb99abfd0daf62cff13a09eb694ebfa633a365d224aefc6449f97de
Gozi
e192656ce9c73ac7bcb4cec136378c5843e128b76cd1c021aeec274edecbf869
Gozi
e5b7d5095453c566c3313d76b6ce97a5de2b332902c1d9b0b2a3cdb097e94387
Gozi
ee46bd47dbd009333a72bc752b3d38d5a87a25f90fef3d4d77515d4fd11f3c8d
Gozi
+ 158 additional samples on MalwareBazaar
Result
Malware family:
gozi_ifsb
Create hunting rule
Score:
  10/10
Tags:
family:gozi_ifsb botnet:1900 banker trojan
Link:
https://tria.ge/reports/221011-p2cbaaegem/
Behaviour
Gozi, Gozi IFSB
Malware Config
C2 Extraction:
tel12.msn.com
194.76.225.60
185.212.47.133
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/de4224d7-975c-4b95-b364-243edfeb2425
Unpacked files
SH256 hash:
53a152ce008fbe0a467f7816ed237692b3839495425b3b28844a5a032630a9e9
MD5 hash:
4daae4e5b599410b39b55833d61819e7
SHA1 hash:
8769d522b951aa86259e5239919045adaed05daa
Detections:
ISFB_Main
Create hunting rule
win_isfb_auto
Create hunting rule
Link:
https://www.unpac.me/results/ce9c503a-6b2e-48b5-9fb3-2310418d18fc/
SH256 hash:
6b722961edc010c5487de4ef7eee84b586ac3c3f06dbd1920935ea5f7bb90543
MD5 hash:
3b892bea0f8cbe0b61ee380743567d1d
SHA1 hash:
90522132e3a97e966e5270a8e105cc33f0d6c4e5
Link:
https://www.unpac.me/results/ce9c503a-6b2e-48b5-9fb3-2310418d18fc/
Malware family:
Ursnif
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6b722961edc0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.20
Link:
https://yomi.yoroi.company/submissions/6b722961edc010c5487de4ef7eee84b586ac3c3f06dbd1920935ea5f7bb90543

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_isfb_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.isfb.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/318950/

Comments