MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8a7f259ecd7479314c5bd6e449a7b77f76173d4e636075f99a0b8eb765d3573a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 15


Intelligence 15 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8a7f259ecd7479314c5bd6e449a7b77f76173d4e636075f99a0b8eb765d3573a
SHA3-384 hash: 68a4c789eeacf2490894ad324c42299449a56cfddaab217a9f1212019758035c8e14d59adf54e5c09c3b2b3495f3a372
SHA1 hash: c5c09029fd15ee2faa0f5b8bdcab61f4ecba5858
MD5 hash: 2aa94a6251fd3fba8c103ccf82d81879
humanhash: salami-alaska-nitrogen-kitten
File name:8a.exe
Download: download sample
Signature Gozi
Create hunting rule
File size:38'400 bytes
First seen:2022-09-23 07:23:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a225a198dd77b77924eb15a705beb665 (16 x Gozi)
ssdeep 768:usdUYVI40pItlyIwsiFStoXIwJag6kUL7rpM7Pokx88hsUA:HFVI4ttlliYWRJYLPG0kRNA
TLSH T16203F101FA508D63CB57D3F75762E038DFAA032B3578DD43FA161A9940BA19DC4BD542
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter 0x746f6d6669
Tags:exe Gozi

Intelligence

File Origin
# of uploads :
1
# of downloads :
316
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/312540/
Detection(s):
Win.Malware.GoziISFB-9940853-1
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Using the Windows Management Instrumentation requests
Sending a custom TCP request
DNS request
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/38544/overview
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/632d5f5339767769653efd60/reports/3e9e20d9-9bda-4a2f-bfca-5f96069e60a3/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Ursnif
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8cd93daf-e1e8-4ee8-bc72-6af5408c4fc1
Result
Threat name:
Ursnif
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1075751
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Found API chain indicative of debugger detection
Found evasive API chain (may stop execution after checking system information)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Writes or reads registry keys via WMI
Writes registry values via WMI
Yara detected Ursnif
Behaviour
Behavior Graph:
Download SVG
Detection:
gozi
Create hunting rule
Link:
https://mwdb.cert.pl/sample/8a7f259ecd7479314c5bd6e449a7b77f76173d4e636075f99a0b8eb765d3573a/
Threat name:
Win32.Infostealer.Gozi
Create hunting rule
Status:
Malicious
First seen:
2022-08-14 00:43:11 UTC
File Type:
PE (Exe)
AV detection:
24 of 26 (92.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rj7slhwnor4tctc323setj5xp53bopkomnqhl6m2bohlozotk45a._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Result
Malware family:
gozi_ifsb
Create hunting rule
Score:
  10/10
Tags:
family:gozi_ifsb botnet:20000 banker trojan
Link:
https://tria.ge/reports/220923-h8dz5ahdgr/
Behaviour
Gozi, Gozi IFSB
Malware Config
C2 Extraction:
trackingg-protectioon.cdn1.mozilla.net
185.240.103.79
weiqeqwns.com
wdeiqeqwns.com
weiqeqwens.com
weiqewqwns.com
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/6ab19392-253a-4a9a-8008-2508901e5ea7
Unpacked files
SH256 hash:
bd48d2ca9fc8aa44bdee5fe564c15cb8fff88da0081cae06e6a3153ea599f48a
MD5 hash:
851e3931eb9af443aebe8abdb60f9469
SHA1 hash:
b13e1900449afbb908511dee343a14442a0fbbc1
Detections:
win_isfb_auto
Create hunting rule
Link:
https://www.unpac.me/results/144befaf-bf26-4f4d-a271-fd70fafaa154/
SH256 hash:
8a7f259ecd7479314c5bd6e449a7b77f76173d4e636075f99a0b8eb765d3573a
MD5 hash:
2aa94a6251fd3fba8c103ccf82d81879
SHA1 hash:
c5c09029fd15ee2faa0f5b8bdcab61f4ecba5858
Link:
https://www.unpac.me/results/144befaf-bf26-4f4d-a271-fd70fafaa154/
Malware family:
Ursnif
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8a7f259ecd74/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.34
Link:
https://yomi.yoroi.company/submissions/8a7f259ecd7479314c5bd6e449a7b77f76173d4e636075f99a0b8eb765d3573a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:RansomwareTest6
Create hunting rule
Author:Daoyuan Wu
Description:Test Ransomware YARA rules
Rule name:RansomwareTest7
Create hunting rule
Author:Daoyuan Wu
Description:Test Ransomware YARA rules
Rule name:win_isfb_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.isfb.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/312540/

Comments