MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 715cd8f5ce329b92ed0361a50ce7cc90e7b34746380542c040b85d09d3a4fcff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Gozi
Vendor detections: 12
| SHA256 hash: | 715cd8f5ce329b92ed0361a50ce7cc90e7b34746380542c040b85d09d3a4fcff |
|---|---|
| SHA3-384 hash: | 20ae1bd484da08393604e966219fd1fe985c61431fdc773f0c61adcd24b969ac54f20f08ef6d54187c8a87059861bac0 |
| SHA1 hash: | 9514f33b0e0ce4814c422c754f5181a9337b6d4b |
| MD5 hash: | bbcc8ce7492115e5970d0b47f9432f07 |
| humanhash: | william-nitrogen-vegan-table |
| File name: | 6409a699e5cca.dll |
| Download: | download sample |
| Signature | Gozi |
| File size: | 686'592 bytes |
| First seen: | 2023-03-09 09:28:41 UTC |
| Last seen: | 2023-03-09 18:56:44 UTC |
| File type: |  dll |
| MIME type: | application/x-dosexec |
| imphash | 3646c4230f080994fdd35bd1af4b11fc (1 x Gozi) |
| ssdeep | 12288:fcmMRzyQI3Ng+k+f1EuzWrlKkI3I6SZk95VnedDBJhx0W:NMR+93k82uyr0zIfrD |
| Threatray | 405 similar samples on MalwareBazaar |
| TLSH | T1B0E47D23B2E1893BC0631A745DEBA6B5693ABF012A248D476BF01D4C5F397B039163D7 |
| TrID | 17.5% (.EXE) Win32 Executable Delphi generic (14182/79/4) 16.1% (.SCR) Windows screen saver (13097/50/3) 16.0% (.EXE) DOS Executable Borland C++ (13007/5/3) 12.9% (.EXE) Win64 Executable (generic) (10523/12/4) 12.3% (.EXE) DOS Borland compiled Executable (generic) (10000/1/2) |
| File icon (PE): |  |
| dhash icon | 389ce47474d0c064 (1 x Gozi, 1 x Quakbot) |
| Reporter |  JAMESWT_WT |
| Tags: | dll GLS Gozi ITA Ursnif |
Intelligence
File Origin
# of uploads :
6
# of downloads :
255
Origin country :
ITVendor Threat Intelligence
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Сreating synchronization primitives
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
greyware keylogger packed
Verdict:
Suspicious
Labled as:
Malware
Malware family:
Ursnif
Verdict:
Malicious
Result
Threat name:
Ursnif
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Signature
Found stalling execution ending in API Sleep call
Malicious sample detected (through community Yara rule)
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Writes or reads registry keys via WMI
Writes registry values via WMI
Yara detected Ursnif
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Gozi
Status:
Malicious
First seen:
2023-03-09 09:41:12 UTC
File Type:
PE (Dll)
Extracted files:
68
AV detection:
14 of 24 (58.33%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
gozi
Similar samples:
+ 395 additional samples on MalwareBazaar
Result
Malware family:
gozi
Score:
10/10
Tags:
family:gozi botnet:5050 banker isfb trojan
Behaviour
Suspicious use of WriteProcessMemory
Gozi
Malware Config
C2 Extraction:
https://config.edge.skype.com
157.254.195.117
91.215.85.151
157.254.195.117
91.215.85.151
Unpacked files
SH256 hash:
901bc2e600e21d9e17d813824d7ae08e66f4753a3f3136c8fea691bdab446921
MD5 hash:
1c24a5d16103c3af65b114ec3385cedc
SHA1 hash:
4fd81ad91a3b776644b03c81677b5a734b6990fa
SH256 hash:
27c92574e42cfa56475a28f14b24da696ba4581ef154dd5e63c527b0dba187d1
MD5 hash:
54669342141c94fe97be782c1eb4e544
SHA1 hash:
2c5423959588169a875c2af04d5597223224d81a
SH256 hash:
715cd8f5ce329b92ed0361a50ce7cc90e7b34746380542c040b85d09d3a4fcff
MD5 hash:
bbcc8ce7492115e5970d0b47f9432f07
SHA1 hash:
9514f33b0e0ce4814c422c754f5181a9337b6d4b
Malware family:
Ursnif
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
ursnif3
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.