MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a48d706feeca03ea7eed4ab580f75a5562f852845f611a0615b7d3b66f85667. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7a48d706feeca03ea7eed4ab580f75a5562f852845f611a0615b7d3b66f85667
SHA3-384 hash: 2f3ee958677a72cd10a6e955ed6ed786076d9acd6807fd5cdaa3ad3701fa5316bc7d180a0463cef63374cab9c2306c22
SHA1 hash: 4d088d2a01621b92f18c6d2d1f71784ee2c9b4a6
MD5 hash: 823e3817cda81d60fd0dfb5fe851de13
humanhash: kansas-pluto-summer-stairway
File name:SecuriteInfo.com.Variant.Graftor.770268.2661.31642
Download: download sample
Signature Gozi
Create hunting rule
File size:229'888 bytes
First seen:2020-07-21 02:00:18 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 87fc93cb54b57f245d75a270795c77aa (114 x Gozi, 1 x TrickBot)
ssdeep 3072:U6VYA6I0oElwS9ciW+eM+ppv2LHFzp6+7bUSrtB0J3B1rq46vqDyPIKpPLq/M:UWxXElK+Spv2RwSlt6JR1YSDuImq/M
Threatray 785 similar samples on MalwareBazaar
TLSH E4248D0075848039E9BF02364A7ED668467CBD218BA1D9EBB7C84E4F5B390D27B31767
Reporter SecuriteInfoCom
Tags:Gozi

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/29505/
Detection(s):
SecuriteInfo.com.Variant.Graftor.770268.2661.31642.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Result
Threat name:
IcedID
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/392210
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7a48d706feeca03ea7eed4ab580f75a5562f852845f611a0615b7d3b66f85667/
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 02:02:07 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
icedid
Create hunting rule
gozi
Create hunting rule
Similar samples:
16820bf3fb6e0a8c9f4b5790fb5dfc8c835cf7c96c9bf44cc1b092b1a1849e9d
Gozi
23b3a2baa530530acde54186c3d9f2ed3be74a9465a6417b2d266f18bdb9e070
Gozi
3d321c9e2f63ea70c5701e85f766980a9e978e802907d1a4d8f0aee2ceb9e709
Gozi
50c534de93fde3f578fc4b0a090a97673ff6c44e8ceb344c1b706a1bf523bb8e
Gozi
517801ae25fbba7eecba22323f0375712d0ffe00178a12c983cff0cf28365d73
Gozi
61b4fc40c6bb3a1902d799dfbc89b2c4c1aa0b7b06998a966ff57cf11a1ea138
Gozi
86c4a0358f3fd1bf879f3cb043fe032cb24e86fe5f099183a15ab8776e88ee7e
Gozi
9ca52c7b92eb37c87f7e8519fb9e369643b0d21b313dc7efae65099889a4e962
Gozi
be4645b3f41904727a3c03d7374aabe7cc4573385579e34bb0c97358b7252083
Gozi
f925664a36fcddaf5c9d04ab3dab7f282eff2b6698279af6772bc41af6ca640a
Gozi
+ 775 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/200721-5l3z2n5jy2/
Behaviour
Suspicious use of WriteProcessMemory
Modifies system certificate store
Suspicious use of WriteProcessMemory
Blacklisted process makes network request
Blacklisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7a48d706feeca03ea7eed4ab580f75a5562f852845f611a0615b7d3b66f85667

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gozi

DLL dll 7a48d706feeca03ea7eed4ab580f75a5562f852845f611a0615b7d3b66f85667

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/415201/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/415635/
Cape
Cape
https://www.capesandbox.com/analysis/29505/

Comments