MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8e34c697b603788b9baeecfb375c466cb8468a322d6ae9b81fc41fb61472c3da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8e34c697b603788b9baeecfb375c466cb8468a322d6ae9b81fc41fb61472c3da
SHA3-384 hash: 8a5ecb5b8c3810a1dc81623e65d0b0926b9609fa601b565409204a59eabc74eba3600a55dc5d3d0b89809f58f87310d5
SHA1 hash: 56b1b5066f88e07f494e5e97f9a8b791cc9d7bd2
MD5 hash: 5268c190b3a6940bc7c8f0361f3a187f
humanhash: pasta-india-friend-august
File name:5268c190b3a6940bc7c8f0361f3a187f.dll
Download: download sample
Signature Gozi
Create hunting rule
File size:313'176 bytes
First seen:2021-01-11 18:15:26 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 302dc27ee8fb51d51fd455c5c954a121 (3 x ZLoader, 1 x Gozi)
ssdeep 1536:34UeRdT1u9JFuuhY03X67MMOo+xT0/7Hbo5ioQ+pQ:IUe2aW6CKE5rQ
Threatray 88 similar samples on MalwareBazaar
TLSH C664ED07968B9F0DC72D61F6F8FA672E5165D40E1D082D0C73ACD6B1F1E3598BC90A8A
Reporter abuse_ch
Tags:dll Gozi

Intelligence

File Origin
# of uploads :
1
# of downloads :
246
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Ursnif3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/111324/
Detection(s):
SecuriteInfo.com.Generic.mg.5268c190b3a6940b.6386.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Using the Windows Management Instrumentation requests
Launching a process
Creating a window
DNS request
Searching for the window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Ursnif
Create hunting rule
Detection:
malicious
Classification:
bank.troj
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/578274
Signature
Creates a COM Internet Explorer object
Multi AV Scanner detection for submitted file
Writes or reads registry keys via WMI
Writes registry values via WMI
Yara detected Ursnif
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 338189 Sample: OgQJzDbLce.dll Startdate: 11/01/2021 Architecture: WINDOWS Score: 68 31 Multi AV Scanner detection for submitted file 2->31 33 Yara detected  Ursnif 2->33 6 loaddll32.exe 1 2->6         started        9 iexplore.exe 1 50 2->9         started        12 iexplore.exe 1 50 2->12         started        14 2 other processes 2->14 process3 dnsIp4 35 Writes or reads registry keys via WMI 6->35 37 Writes registry values via WMI 6->37 39 Creates a COM Internet Explorer object 6->39 29 192.168.2.1 unknown unknown 9->29 16 iexplore.exe 31 9->16         started        19 iexplore.exe 28 12->19         started        21 iexplore.exe 35 14->21         started        23 iexplore.exe 32 14->23         started        signatures5 process6 dnsIp7 25 babidone.top 193.56.255.166, 80 INFOCLOUD-SRLMD Romania 16->25 27 begoventa.top 92.38.132.181, 49770, 49771, 80 GCOREAT Austria 19->27
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8e34c697b603788b9baeecfb375c466cb8468a322d6ae9b81fc41fb61472c3da/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-11 18:16:05 UTC
AV detection:
9 of 46 (19.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ry2mnf5wan4ixg5o5t5toxcgns4encrsfvvotoa7yqp3mfdsypna._file
Verdict:
malicious
Similar samples:
00af5f13551c5e20fe29ec3d12dca555a56cd1edcd0a8633373872334de485ae
Gozi
0c84acf6d63976812d17da46fc3b8bf1128bbfd5f717262f20e25f3598484a9b
Gozi
0fb4779661fe23fdcd79c77fc74e721b637b496abe2eb26da28d12055af7b458
Gozi
2900169349643be6f77530141614eeac56e7b22387b9acf866ed4e4922e32401
Gozi
4d36701a7ece574dda56feaca4b70d9ee395ccf6c6522142028120b62324efc8
Gozi
550baac0b4b99acf919e29a691523acb8c1b88277b1d2f2340b2e9dc37f9110a
Gozi
907ef06dae099405a2d6368af5306ccd1a40fea4b760a732289427edf19d12c3
Gozi
9cabfa3e674b0274b3b802695b49d9634e027fb15aa827afaf793104f7317690
Gozi
af5030e85147368bd9ad59c09a39cbf28ecde7c7fb93e5b659346f424b3593f3
Gozi
e33157d0b5973fb880934006b1427f5ad53ae3f471e81a9a8460772d7f5b3657
Gozi
+ 78 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210111-f6rbs3f8zj/
Behaviour
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Unpacked files
SH256 hash:
8e34c697b603788b9baeecfb375c466cb8468a322d6ae9b81fc41fb61472c3da
MD5 hash:
5268c190b3a6940bc7c8f0361f3a187f
SHA1 hash:
56b1b5066f88e07f494e5e97f9a8b791cc9d7bd2
Link:
https://www.unpac.me/results/23588a7f-268d-4365-b849-ddf0ebc14a66/
SH256 hash:
af3d848a32f097bfb957918422c6cd0858f2da3d353bf30071ccbed446698dad
MD5 hash:
0f8aba5017e9117d8bb52eb3215d9240
SHA1 hash:
407330126bd5408a3215d1f89959d202ad871793
Detections:
win_isfb_auto
Create hunting rule
Link:
https://www.unpac.me/results/23588a7f-268d-4365-b849-ddf0ebc14a66/
Parent samples :
8e34c697b603788b9baeecfb375c466cb8468a322d6ae9b81fc41fb61472c3da
e5dc940537146c1c56b8a8f91234484c83223943c13d2fbf354f0cfdec13c258
SH256 hash:
883ebaf8f36a1e7c7326f539860d1ba3f7f8ab73b0c8f7e115db6feb79dcd282
MD5 hash:
13bae447c9b9a7f7da161796fbcde6cf
SHA1 hash:
4142f5344a44b7b23437f80085d691b67296a026
Detections:
win_isfb_auto
Create hunting rule
Link:
https://www.unpac.me/results/23588a7f-268d-4365-b849-ddf0ebc14a66/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8e34c697b603788b9baeecfb375c466cb8468a322d6ae9b81fc41fb61472c3da

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ursnif3
Create hunting rule
Author:kevoreilly
Description:Ursnif Payload
Rule name:win_isfb_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gozi

DLL dll 8e34c697b603788b9baeecfb375c466cb8468a322d6ae9b81fc41fb61472c3da

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/952951/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/111324/

Comments