MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 73a0eff4b25b824af4b6600db0f637f991b45b0945c9385fd6e7eca289b7e5ed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 4


Intelligence 4 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 73a0eff4b25b824af4b6600db0f637f991b45b0945c9385fd6e7eca289b7e5ed
SHA3-384 hash: 5aa6b1c4e0fd01f7f8c951daff8b7be8608e18f3d19d9bf2c3cf9bc1c0f6658b55ad8057a98aaa42c838e937e309d16b
SHA1 hash: 44886d0f82413e2671b3923ac71de255d67f5f21
MD5 hash: 5e98f53361c594d53f907c12919b2c19
humanhash: utah-oregon-nineteen-floor
File name:SecuriteInfo.com.Trojan.PWS.Papras.2867.23368.32524
Download: download sample
Signature Gozi
Create hunting rule
File size:488'960 bytes
First seen:2020-06-19 14:43:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 15bfd7a69cdcb17176fb4ac7736927b1 (1 x Gozi)
ssdeep 12288:I8YRQPzZ9KBD4cI1siD8YhLN9b3WybU7aEIp2:zyYq4cysP4LTb3WyA7p
Threatray 17 similar samples on MalwareBazaar
TLSH 4CA4F1107650C273F48140B97A59D6E065383A3127A2E4CB3BC56FBC5A307EDA772B6B
Reporter SecuriteInfoCom
Tags:Gozi

Intelligence

File Origin
# of uploads :
1
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/9593/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Papras.2867.23368.32524.UNOFFICIAL
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Ursnif
Create hunting rule
Status:
Malicious
First seen:
2018-01-12 23:15:29 UTC
File Type:
PE (Exe)
Extracted files:
5
AV detection:
42 of 47 (89.36%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
0fefdfbc442c4667670b1b9001f1b586dbf7d7eeb13bcaf21af53984d5ad14a6
Gozi
1495a59a2300245b0c8cfdfe2e467de7f79a4d287e10e9119a96cdac0a1b7c5b
Gozi
2a80deaa083bb554ccc57c0ffd467b4fd1a6e2f1ae6ab1a3de140aab849b19bf
Gozi
30785da049b13f1cd228be54f6ce25d801f3fc4890dada9464830e078df7cf94
Gozi
361fb6895164e8e130e6fc3f6dc984af355294173c5e385d0ac35d6df61aea60
Gozi
57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd
Gozi
823d3e4a009254382cf9401cffddeb21e5be60ab5bb283ad325734c8c14cd695
Gozi
b0d9f78957650a0bc42b0bf646e3d158f713de64ee5e6ab395cf777e93a7a240
Gozi
bc2cea17da33c23edbb0c86ab00b3ec3b4a2f4da84fb075922e41b7bf6b654f0
Gozi
f86974cc3a2a1d06dcc4effe66d6e27380dd4e4e4fe254a1b88a3ea3c7e681c4
Gozi
+ 7 additional samples on MalwareBazaar
Result
Malware family:
gozi_ifsb
Create hunting rule
Score:
  10/10
Tags:
family:gozi_ifsb banker persistence spyware trojan
Link:
https://tria.ge/reports/201109-pwsfk5arfj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of UnmapMainImage
Suspicious use of SetThreadContext
Adds Run key to start application
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Gozi, Gozi IFSB
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:GoziRule
Create hunting rule
Author:CCN-CERT
Description:Win32.Gozi
Rule name:Ursnif
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Ursnif(a.k.a. Dreambot, Gozi, ISFB) in memory
Reference:internal research
Rule name:win_dreambot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_isfb_a4
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT
Rule name:win_isfb_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/9593/

Comments