MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 899b285e89b2d29903bf9f7b391fdaf9a9134b1e41085924fd8cdebc8cd29f8f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	899b285e89b2d29903bf9f7b391fdaf9a9134b1e41085924fd8cdebc8cd29f8f
SHA3-384 hash:	84ed8681d285f7276b8e7171b42ec371ed8ec5b92fbcb063b147f99c74f62d867cf7b36fce397d7ba7b4bc814f3bc0f3
SHA1 hash:	135853a9d5cca92c513993556266ccc8a0873146
MD5 hash:	78d279d18d0c606ddd02030b847e707f
humanhash:	berlin-high-tennessee-high
File name:	agenzia_delle_entrate.zip
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	553 bytes
First seen:	2023-01-23 09:12:09 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	12:5jcFttJtynnXiN0unTuAZrcqObtB9tZzAF:9cFtkym0TuAZrcqObtBa
TLSH	T180F0E98942194B13C32EC7BBF5C4A07D1B21A869155B99A7072C0377444E378CE1A494
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	JAMESWT_WT
Tags:	agenziaentrate Gozi Ursnif zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

104

Origin country :

IT

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	agenzia_delle_entrate.url
File size:	196 bytes
SHA256 hash:	a176d8492280d6d1dffa5718d60105d4075819d70367fb2a607ca043a6211f34
MD5 hash:	d273f561c334583fb9a22ef1c32d08a2
MIME type:	text/plain
Signature	Gozi

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

TwinWave.EvilShortcut.DottedQuadDancingInHeavenZip.20230105.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilShortcut.DottedQuadDancingInHeaven.20230105.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

80%

Tags:

remote

Link:

https://www.filescan.io/uploads/63ce4f9e1c9cbf7d6251984d/reports/87942466-5acd-43a7-a04f-d2f48692a9bc/overview

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/899b285e89b2d29903bf9f7b391fdaf9a9134b1e41085924fd8cdebc8cd29f8f/

ReversingLabs TitaniumCloud Script-JS.Trojan.Ursnif

Threat name:

Script-JS.Trojan.Ursnif

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-01-23 09:13:05 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

6 of 26 (23.08%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rgnsqxujwljjsa57t55tsh627gurgsy6ieefsjh5rtplzdgst6hq._file

Hatching Triage gozi

Result

Malware family:

gozi

Alert

Create hunting rule

Score:

  10/10

Tags:

family:gozi botnet:7707 banker isfb trojan

Link:

https://tria.ge/reports/230123-lerkxaed31/

Behaviour

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Gozi

Malware Config

C2 Extraction:

checklist.skype.com
62.173.149.10
31.41.44.27
193.0.178.235

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/899b285e89b2d29903bf9f7b391fdaf9a9134b1e41085924fd8cdebc8cd29f8f