MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 847b4ccd103040ed44a16bba6610627107821eedc8df816782c1d095d44100d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	847b4ccd103040ed44a16bba6610627107821eedc8df816782c1d095d44100d5
SHA3-384 hash:	f8f480f3eadaf321c97d2f25701f84bf44d23474ec6c9c85e4698f3a9552af996cb11ac29ad5cd862b740c303d81722a
SHA1 hash:	bcd5d80fd23caf9a5878218001e7c20d6c2060be
MD5 hash:	99c144042b4cdea7181c4e082f7172c8
humanhash:	whiskey-fruit-may-fish
File name:	server.exe
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	369'152 bytes
First seen:	2023-03-22 07:20:29 UTC
Last seen:	2023-04-03 09:33:39 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	c3df3d0d993bdeac73a0f5fd62093e4d (6 x Gozi, 3 x Stealc, 3 x LaplasClipper)
ssdeep	3072:+VRilm8dar4jb9ZRhkNfAcLo04JyVnlT8M43xqwcnUi6JIUjixCUgwn0F:8RiD2OQVlTa3xB0UK
Threatray	479 similar samples on MalwareBazaar
TLSH	T1B2747EC293E16C20E5124B32BE1FCBF82A1EFC619E557BAE23596E3F0970163D152719
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	012111092915210c (1 x Gozi)
Reporter	JAMESWT_WT
Tags:	agenziaentrate exe Gozi isfb ITA MEF mise Ursnif

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

264

Origin country :

IT

Vendor Threat Intelligence

ANY.RUN

Malware family:

n/a

ID:

1

File name:

server.exe

Verdict:

No threats detected

Analysis date:

2023-03-22 07:24:21 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/9ebbd7cc-b8af-4843-aef7-9574b6d649ff

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/376389/

ClamAV Detected

Detection(s):

Sanesecurity.Malware.29059.BadIN.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

greyware lockbit packed

Link:

https://www.filescan.io/uploads/641aac60da1bbe29caf97452/reports/25b1107f-5b47-429b-8dc6-91cfef47545e/overview

Hybrid Analysis Malware

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/847b4ccd103040ed44a16bba6610627107821eedc8df816782c1d095d44100d5

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Ursnif

Malware family:

Ursnif

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a137a09b-921a-4a90-9cee-e494d1fd894a

Joe Sandbox Ursnif

Result

Threat name:

Ursnif

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1199099

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found API chain indicative of debugger detection

Found evasive API chain (may stop execution after checking system information)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Writes or reads registry keys via WMI

Writes registry values via WMI

Yara detected Ursnif

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB gozi

Detection:

gozi

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/847b4ccd103040ed44a16bba6610627107821eedc8df816782c1d095d44100d5/

ReversingLabs TitaniumCloud Win32.Trojan.Smokeloadder

Threat name:

Win32.Trojan.Smokeloadder

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-03-22 07:21:07 UTC

File Type:

PE (Exe)

Extracted files:

44

AV detection:

19 of 24 (79.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qr5uztiqgbao2rfbno5gmedcoedyehxnzdpycz4cyhijlvcbadkq._file

Threatray gozi

Verdict:

malicious

Label(s):

gozi

Alert

Create hunting rule

Similar samples:

061c271c0617e56aeb196c834fcab2d24755afa50cd95cc6a299d76be496a858

Gozi

19a9a43b36d2ed6516e4b1d8368cb3af64362507d2b30f4cb742fbe50780ee89

Gozi

38befee4c4513de47e667544d9f705f56c195393b116fcd154755c1f7815ae55

Gozi

3af96098ccb1063f1538e255f328e78f9556e29cd0563c53d2a73569759b5d0e

Gozi

a9f25933eb0dc82972d77854034dbc86220088eff4758a7df4e65f87ee1745e1

Gozi

aa96b7f6516f3f8d7d63d61a30b3af156b92b3e8dace05c8953dcf82ac96a3c6

Gozi

bbe2063bd1c92ccc4cc3b0320ca484909ba0db5e44e508249b8ec24237404b1d

Gozi

c95c8b01e7a58afbae1b0c3a795108ae46b22c3867680dcdb883ca97e6f092a0

Gozi

cff404581196accfce86e8ba7a5b8f63b686ef831e384d95e46a04f908e0987a

Gozi

fc74e8faf8772293f2947c803c5309c64310c38d8e3f8efe18271004a9b96bba

Gozi

+ 469 additional samples on MalwareBazaar

Hatching Triage gozi

Result

Malware family:

gozi

Alert

Create hunting rule

Score:

  10/10

Tags:

family:gozi botnet:7715 banker isfb trojan

Link:

https://tria.ge/reports/230322-h6nfsahd51/

Behaviour

Gozi

Malware Config

C2 Extraction:

checklist.skype.com
62.173.142.50
31.41.44.87
109.248.11.217
212.109.218.151
5.44.45.83
62.173.142.81
193.233.175.113
109.248.11.184
212.109.218.26
185.68.93.7

UnpacMe ISFB_Main win_isfb_auto

Unpacked files

SH256 hash:

bdede3976c3e0845c12260085e70adce7e7a62aea7278e0b07aa9649adfc0a82

MD5 hash:

65e9baf78b7a0b4d5e9a3d77d64ba197

SHA1 hash:

6b49cac47736c272b5a50addeacef0c0b9fd295c

Link:

https://www.unpac.me/results/534567cf-1649-4361-8a2e-2adcabf5d87b/

SH256 hash:

ef55057af7fb05f07ba94cf79ffd9e12f3a77eb3f08efb24bb8aa178e912e36f

MD5 hash:

7be96204ad39ac7430454d79d59bee54

SHA1 hash:

3295130c563c8ba2964e056c06822c5b6b69b5c8

Detections:

ISFB_Main

Alert

Create hunting rule

win_isfb_auto

Alert

Create hunting rule

Link:

https://www.unpac.me/results/534567cf-1649-4361-8a2e-2adcabf5d87b/

Parent samples :

847b4ccd103040ed44a16bba6610627107821eedc8df816782c1d095d44100d5
75827be0c600f93d0d23d4b8239f56eb8c7dc4ab6064ad0b79e6695157816988
4a1ceb484536bd1fe3da65c76d7ec161d06190960e1623dfc89c444fa4b4fde0
0c34693df38fb1cfe4eb93a2e52f6d41444ad40d852224be14243dabe745ed4c
83ece9c5d6ffe0e99276becec96bc1c181a731ebd2fb95eaef329d2fbbec7271
97fcb2199876005f3e4db6aa7280b15cd59dfe0b99c1fc0e722adb31f0d2e6b4
541a131186c7861caf0517567d8c6208f2f95712b637a488ac6fbbfe7756efdc
714c9d8e64376bcc4cd7ed89b448e256144c40e1e6705a686dabf201d3bdfb74
07f1cd7945372b991c0757e24fe9d44d98dbcb3dfb9bea6bd80449c00ea06504
55f2027f0bc97eb90355209216c8d870d9d08f5c8eda5afbb7f9142abde2ed2c
d5ad49b4519f7c8d63ac988b81d615ab12a4d5bc64a691681ae6161b141a37e1

SH256 hash:

847b4ccd103040ed44a16bba6610627107821eedc8df816782c1d095d44100d5

MD5 hash:

99c144042b4cdea7181c4e082f7172c8

SHA1 hash:

bcd5d80fd23caf9a5878218001e7c20d6c2060be

Link:

https://www.unpac.me/results/534567cf-1649-4361-8a2e-2adcabf5d87b/

VMRay Ursnif

Malware family:

Ursnif

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/847b4ccd1030/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/376389/