MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 876860a923754e2d2f6b1514d98f4914271e8cf60d3f95cf1f983e91baffa32b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 13


Intelligence 13 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 876860a923754e2d2f6b1514d98f4914271e8cf60d3f95cf1f983e91baffa32b
SHA3-384 hash: ef7fbb5a6a6279e1d83a7e7d94ccc6e0b5ae4afee4d1ccb7547fa691995c2238a90673b7e4f4f84f9070819fb4c469ed
SHA1 hash: ebc1777b9ef7242892e8479f3330ed561c370127
MD5 hash: 2beb711bcfd441ca2d92da0313823a41
humanhash: beer-foxtrot-comet-uncle
File name:unpacked_gozi.bin
Download: download sample
Signature Gozi
Create hunting rule
File size:44'544 bytes
First seen:2023-03-01 10:40:42 UTC
Last seen:2023-03-19 05:47:15 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash ef075d26b728b78a932306e24062e80c (7 x Gozi)
ssdeep 768:10gsqVXye2rS/Q4VYXQIVpCHlNBmQWGk2j+A6ewBvu7gpzhK3D1Gc:19sq8S/QEYXQIVWlvmYp6ewNu7hD1Gc
Threatray 388 similar samples on MalwareBazaar
TLSH T1D2138E01F6F948F2C7A31EB06714FBA9A7F9D631223C5155AF2369CA1E60953E13D20B
TrID 30.2% (.EXE) Win64 Executable (generic) (10523/12/4)
18.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
14.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
12.9% (.EXE) Win32 Executable (generic) (4505/5/1)
5.9% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter Viuleeenz
Tags:agenziaentrate dll Gozi unpacked Ursnif

Intelligence

File Origin
# of uploads :
2
# of downloads :
221
Origin country :
IT IT
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/370777/
Detection(s):
Win.Malware.Ursnif-9975502-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
greyware packed shell32.dll
Link:
https://www.filescan.io/uploads/63ff2bbfbbedb8176ff1f20a/reports/7a8faa1d-200b-4b89-8502-d41f8f0b7fed/overview
Verdict:
Malicious
Labled as:
Ursnif.1.Generic
Link:
https://www.hybrid-analysis.com/sample/876860a923754e2d2f6b1514d98f4914271e8cf60d3f95cf1f983e91baffa32b
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Ursnif
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ac4965bc-8318-46d2-bcd0-dccba2fef79b
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1184811
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 817663 Sample: unpacked_gozi.bin.dll Startdate: 01/03/2023 Architecture: WINDOWS Score: 68 15 Malicious sample detected (through community Yara rule) 2->15 17 Antivirus / Scanner detection for submitted sample 2->17 19 Multi AV Scanner detection for submitted file 2->19 21 Machine Learning detection for sample 2->21 7 loaddll32.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        11 conhost.exe 7->11         started        process5 13 rundll32.exe 9->13         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/876860a923754e2d2f6b1514d98f4914271e8cf60d3f95cf1f983e91baffa32b/
Threat name:
Win32.Trojan.Ursnif
Create hunting rule
Status:
Malicious
First seen:
2023-03-01 10:41:05 UTC
File Type:
PE (Dll)
AV detection:
24 of 25 (96.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=q5ugbkjdovhc2l3lcukntd2jcqtr5dhwbu7zlty7ta7jdox7umvq._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
84908c9c014c59a36369a618dfc51316646d1dbc3314da3c66100b0706567d22
Gozi
9cc3318cdf29c5b6a1c170facbd0e7849b674ecd2072d9741424709e0931f8cf
Gozi
a42fad7a44006d21404affed1fb90a67ecf5e2bc6436dc3729705ca29b4f91e4
Gozi
cff404581196accfce86e8ba7a5b8f63b686ef831e384d95e46a04f908e0987a
Gozi
dcc33bc510228ff4cf4dc286e5902be5a262e3def4189960c702d27b83da84b2
Gozi
df9bc10545b7066ec3bc8868a9e20379aa9a7cbb38928902520eea8fdd3ac2a7
Gozi
+ 378 additional samples on MalwareBazaar
Result
Malware family:
gozi
Create hunting rule
Score:
  10/10
Tags:
family:gozi botnet:7709 isfb
Link:
https://tria.ge/reports/230301-mq39hsfh23/
Behaviour
Suspicious use of WriteProcessMemory
Malware Config
C2 Extraction:
checklist.skype.com
62.173.141.252
31.41.44.33
109.248.11.112
Unpacked files
SH256 hash:
876860a923754e2d2f6b1514d98f4914271e8cf60d3f95cf1f983e91baffa32b
MD5 hash:
2beb711bcfd441ca2d92da0313823a41
SHA1 hash:
ebc1777b9ef7242892e8479f3330ed561c370127
Detections:
ISFB_Main
Create hunting rule
win_isfb_auto
Create hunting rule
Link:
https://www.unpac.me/results/4a46fee8-63fe-4f6a-a1fb-211482b1180b/
Parent samples :
3b3e3f142508409133b565c5ee076574340c6d2eded21b8294db1156c9474858
876860a923754e2d2f6b1514d98f4914271e8cf60d3f95cf1f983e91baffa32b
9d1e71b94eab825c928377e93377feb62e02a85b7d750b883919207119a56e0d
05b73bccd726df4df86b10b00b2ed4d6e6ba9832e3b473dd7abe6c50c8d5bfbf
061c271c0617e56aeb196c834fcab2d24755afa50cd95cc6a299d76be496a858
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/876860a923754e2d2f6b1514d98f4914271e8cf60d3f95cf1f983e91baffa32b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_isfb_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.isfb.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/370777/

Comments