MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8310099f46b3760c683efe9aa247bfaa27334249e8375ddb9e45ee805a47857c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gozi

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	8310099f46b3760c683efe9aa247bfaa27334249e8375ddb9e45ee805a47857c
SHA3-384 hash:	74be073d19623657673dae8632a06c284ed1c95adaac96e323b29f55acd2ea3b4b654e802d16b7dc2536352173189460
SHA1 hash:	642f459b8d535e9acb02160a124c2ec17b2717db
MD5 hash:	93e1f6a018dfd87a6235c247af3a5070
humanhash:	mike-seven-fish-fruit
File name:	93e1f6a018dfd87a6235c247af3a5070.dll
Download:	download sample
Signature	Gozi Create hunting rule
File size:	960'000 bytes
First seen:	2021-05-05 13:18:37 UTC
Last seen:	2021-05-05 13:28:17 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	7a79d10b1d4343a18a4f6e25e165b4ae (62 x Gozi)
ssdeep	24576:HQfpzjXPgfe8CJV4X+IBIJ3cazaLwj1mCG9CpNiLi:IFDg6JV4OaIRj150CpNiLi
Threatray	235 similar samples on MalwareBazaar
TLSH	0915C03138C1C232D573A0780A69D6B04BADB4301D359B9F77DC2B7E6F715A092369AB
Reporter	abuse_ch
Tags:	dll Gozi isfb Ursnif

Intelligence

File Origin

# of uploads :

# of downloads :

244

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Ursnif

Link:

https://www.capesandbox.com/analysis/150619/

Detection(s):

Win.Trojan.Johnnie-9854285-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Running batch commands

Sending a UDP request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

isfb

Link:

https://mwdb.cert.pl/sample/8310099f46b3760c683efe9aa247bfaa27334249e8375ddb9e45ee805a47857c/

Threat name:

Win32.Trojan.Ursnif

Status:

Malicious

First seen:

2021-05-05 13:19:04 UTC

AV detection:

31 of 47 (65.96%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=qmiath2gwn3ay2b672nker57vittgqsj5a3v3w46ixxiawshqv6a._file

Result

Malware family:

gozi_ifsb

Score:

10/10

Tags:

family:gozi_ifsb botnet:4500 banker trojan

Link:

https://tria.ge/reports/210505-prajhj6yxx/

Behaviour

Suspicious use of WriteProcessMemory

Gozi, Gozi IFSB

Malware Config

C2 Extraction:

app3.maintorna.com
chat.billionady.com
app5.folion.xyz
wer.defone.click

Unpacked files

SH256 hash:

8310099f46b3760c683efe9aa247bfaa27334249e8375ddb9e45ee805a47857c

MD5 hash:

93e1f6a018dfd87a6235c247af3a5070

SHA1 hash:

642f459b8d535e9acb02160a124c2ec17b2717db

Link:

https://www.unpac.me/results/c716c8c2-dd36-4871-8a7d-20458f7ccf1f/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	win_isfb_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator