MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 84afc6464d687aa67859c4619af2a1da89bd2cee8803cf706672aee2c43a37bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gozi

Vendor detections: 3

Intelligence 3 IOCs YARA File information Comments

SHA256 hash:	84afc6464d687aa67859c4619af2a1da89bd2cee8803cf706672aee2c43a37bc
SHA3-384 hash:	174ec09f2914444e15eef68304a1104680ca700ef35a71f1ffe8698ec4e1222b775da541369a4da8b466a334e278dc8c
SHA1 hash:	8cd24392a149f3d246b96b76dbbcc78a1abdef1a
MD5 hash:	55057ac29e60d132f8f2d9d2199eb8f4
humanhash:	gee-nebraska-seven-crazy
File name:	ZyGHisczAWv.dll
Download:	download sample
Signature	Gozi Create hunting rule
File size:	1'157'632 bytes
First seen:	2020-03-23 08:21:13 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	e6a364cc92e7954cc7450ca9c77d7c78 (1 x Gozi)
ssdeep	24576:Y7oWi9/IyrRwBWKs7RqFp1iR8oBUxjmziPMB9kjcf+kOjoz:Y8WiZIITRgpA8NxjmziPMB9gcf+Vk
Threatray	639 similar samples on MalwareBazaar
TLSH	0F356DA02F51833DF20B5F3D5A26EA791D43BEE2883474E7B6F42D8B12272875075B64
Reporter	Racco42
Tags:	dll Gozi Ursnif

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

PUA.Win.Packer.PrivateExeProte-11

Gathering data

Threat name:

Win32.Trojan.Ursnif

Status:

Malicious

First seen:

2020-02-28 11:55:26 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

23 of 31 (74.19%)

Threat level:

5/5

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Gozi

vbs b27b22b5264ddeb59889e2df01d327ac26a290686d8dd9b9f1c010e1d2122fd5

Gozi

DLL dll 84afc6464d687aa67859c4619af2a1da89bd2cee8803cf706672aee2c43a37bc

(this sample)

Delivery method

Other

Dropped by

SHA256 b27b22b5264ddeb59889e2df01d327ac26a290686d8dd9b9f1c010e1d2122fd5

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
MULTIMEDIA_API	Can Play Multimedia	MSACM32.dll::acmDriverID MSACM32.dll::acmDriverMessage MSACM32.dll::acmDriverOpen MSACM32.dll::acmDriverPriority MSACM32.dll::acmDriverRemove MSACM32.dll::acmFilterChooseW
SS_API	Uses SS API	Secur32.dll::AcquireCredentialsHandleW Secur32.dll::QueryContextAttributesW
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::SetSystemPowerState KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetStartupInfoA KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::WriteConsoleA KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleOutputCP KERNEL32.dll::GetConsoleCP KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileW KERNEL32.dll::CreateFileA KERNEL32.dll::GetSystemDirectoryW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample