MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7bc9d1453bb84033fd82500f10db64cbf221c4286ed3eba7928249dae6d67675. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 4


Intelligence 4 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7bc9d1453bb84033fd82500f10db64cbf221c4286ed3eba7928249dae6d67675
SHA3-384 hash: affbd3ee11fedbe47e076b499782471c199055f91bedc0d46fb235c6dbf6f01e7cb7b0b2da9c14ab615b290656ae3b7b
SHA1 hash: 4717f01ae2a558a00d509fe184d9f93bb8043e3a
MD5 hash: d6c361f547a7c56c40791098cec92186
humanhash: summer-fillet-solar-pizza
File name:handmade.bin
Download: download sample
Signature Gozi
Create hunting rule
File size:236'544 bytes
First seen:2020-06-18 09:55:14 UTC
Last seen:2020-06-18 11:01:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c95a20cab9164831519248436b4b855d (1 x Gozi)
ssdeep 3072:Ap1FkFamt9H3vAmdKWEfz2BsY4DcflDonb5oDZZQyK3tumnwD:a1FkFamz3omMWKz2BR46ZZQyKK
Threatray 160 similar samples on MalwareBazaar
TLSH 3E348F20B111BA24D6E140B8A1BBFFE8DA2D6D38DFD530CFA2F46876236D1E1253155E
Reporter JAMESWT_WT
Tags:Gozi Ursnif

Intelligence

File Origin
# of uploads :
2
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/19756/
Detection(s):
SecuriteInfo.com.Variant.Ser.Johnnie.5361.1728.13354.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Ursnif
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 07:55:04 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ppe5crj3xbadh7mckahrbw3ezpzcdrbin3j6xj4sqje5vzwwoz2q._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
1dd04b1aea9ce6cfbfc02b62522f7f3c65b4e0cddf89d17ab36387f4de62ef24
Gozi
2026e97bd58d8848dbd55664417790d5ee804bc2fe86ad054cb6a304d2d39a6b
Gozi
4bfb087f701703022fb2d67bc0ee97440d36027d591b6c60ffdf92bb262bf734
Gozi
556d872d8195d87cfc65687c8d99dd0cab17ae02836e31a55bef0e7894e45d4d
Gozi
6746b12200fed6aeb1764594c84ecd3485e74114325c150ba41d12c555b182eb
Gozi
971614ec400a624969d1c3c83bb0b55859a7f069e16c9b4a448527c1b2697dde
Gozi
9a3467911eaf0122aade59ef8636d005f251ef1e6fb23295bdac92376ae0fb82
Gozi
9d0cbdaa28c492fc8deef2174cda055883c9659ecef8b55b502bf75dd59edaea
Gozi
bd6840cc208517847e130db0c847e715ba80a88e210e6383b37c1d0381877ee5
Gozi
cb0373b35abf4b089be60e714ee415d3491ddc2cffcfb45b84a87a3a106c822f
Gozi
+ 150 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/200624-h2rjhjv5d2/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of FindShellTrayWindow
Checks whether UAC is enabled
Modifies Internet Explorer settings
Suspicious use of SetThreadContext
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ursnif
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Ursnif(a.k.a. Dreambot, Gozi, ISFB) in memory
Reference:internal research
Rule name:win_dreambot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_isfb_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/19756/

Comments