MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8f8268c13ddc484a180cff0dd8e764e328897e7a978d0f45e9c26de57f233106. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8f8268c13ddc484a180cff0dd8e764e328897e7a978d0f45e9c26de57f233106
SHA3-384 hash: 394c2fe11e9c59c4a5d32e07343211643f7e067b6d473121c594fa2a2414d4bc2b14db961c48496559e5d21e97ce7a9c
SHA1 hash: b83a8cbcd1b9467406461cbdf58d0bdd4cf8a3a5
MD5 hash: 3d38578600e828c447707199822dacd4
humanhash: five-hot-william-six
File name:Know.dll
Download: download sample
Signature Gozi
Create hunting rule
File size:698'368 bytes
First seen:2021-06-01 05:04:20 UTC
Last seen:2021-06-01 11:39:24 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash f19b9a7ea08f6e7335d27d1febeab85f (1 x Gozi)
ssdeep 12288:djCT8mUIP/MfzluXxWok8sRX0yad9ePV7wU9eOjSA4lhHDenPe19hgU/yutzozMo:djCThrolQxWok8sRJFSAk6e19hgIDc
Threatray 322 similar samples on MalwareBazaar
TLSH C5E46D00B651C039F4B621F44E6AD2BCA62D7EA16B2411EF73D15FEF9A295E06C3131B
Reporter JAMESWT_WT
Tags:dll Gozi isfb Ursnif

Intelligence

File Origin
# of uploads :
3
# of downloads :
441
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Spyware.Ursnif.5834.25809.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Using the Windows Management Instrumentation requests
Launching a process
Creating a window
DNS request
Sending an HTTP GET request
Searching for the window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Ursnif
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/794958
Signature
Found malware configuration
Multi AV Scanner detection for submitted file
Writes registry values via WMI
Yara detected Ursnif
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 427354 Sample: Know.dll Startdate: 01/06/2021 Architecture: WINDOWS Score: 68 29 Found malware configuration 2->29 31 Multi AV Scanner detection for submitted file 2->31 33 Yara detected  Ursnif 2->33 7 loaddll32.exe 1 2->7         started        9 iexplore.exe 1 73 2->9         started        11 iexplore.exe 1 49 2->11         started        process3 process4 13 rundll32.exe 7->13         started        16 cmd.exe 1 7->16         started        18 rundll32.exe 7->18         started        20 iexplore.exe 38 9->20         started        23 iexplore.exe 35 11->23         started        dnsIp5 35 Writes registry values via WMI 13->35 25 rundll32.exe 16->25         started        27 authd.feronok.com 35.199.86.111, 49714, 49715, 49720 GOOGLEUS United States 20->27 signatures6 process7
Detection:
gozi
Create hunting rule
Link:
https://mwdb.cert.pl/sample/8f8268c13ddc484a180cff0dd8e764e328897e7a978d0f45e9c26de57f233106/
Threat name:
Win32.Trojan.Ursnif
Create hunting rule
Status:
Malicious
First seen:
2021-06-01 02:12:53 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
6 of 45 (13.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=r6bgrqj53reeugam74g5rz3e4muis7t2s6gq6rpjyjw6k7zdgeda._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
01fd38efd6b413c52b73ae4bdb563472a37a2ec440a8441a86ed11f4d8f4c5a0
Gozi
18aeff30ba057010d7970ee026856ba163eece1adfaa8adf2bfb08bcad3186dc
Gozi
20c09f055323ec942cb40efc13c0ff06bb7c60f44087e9b8a4a4744bf80935ed
Gozi
304200fb6fd71dc1fd035c1c202a7e7ba4b2679d14592676322b2e550c7223d3
Gozi
3c0bc20be866d4a0156f5b1ebb5418e9e58b65f292f4defbde0052644ca2c0e9
Gozi
478be2a2eff77ac1ad7ff5e048bfb795ff7afd323f8e95b769ad26c40e582f38
Gozi
70f617d8686bdc7d17d4f3b992a27f2532686815aaf5289841b87fd0c198ff3a
Gozi
9969cfd81612d1efbc5e983b57ff2fa2a69a3f6a6812c6da8382bf0c22014cf4
Gozi
9b83ff3af3645baf703075ecce628742d87f3349f08516d5affb105962b4fd6b
Gozi
f09569b61b068a70e2570e2df7bd6ee6c288f8ccc4bd03ceabdf3fb6893261d1
Gozi
+ 312 additional samples on MalwareBazaar
Result
Malware family:
gozi_ifsb
Create hunting rule
Score:
  10/10
Tags:
family:gozi_ifsb botnet:1500 banker trojan
Link:
https://tria.ge/reports/210601-ytnj2fewaa/
Behaviour
Suspicious use of WriteProcessMemory
Gozi, Gozi IFSB
Malware Config
C2 Extraction:
authd.feronok.com
raw.pablowilliano.at
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8f8268c13ddc484a180cff0dd8e764e328897e7a978d0f45e9c26de57f233106

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_isfb_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gozi

DLL dll 8f8268c13ddc484a180cff0dd8e764e328897e7a978d0f45e9c26de57f233106

(this sample)

  
X
https://twitter.com/fr0s7_/status/1399465072292937748?s=20
  
URLhaus
https://urlhaus.abuse.ch/url/1310251/
  
Delivery method
Distributed via web download

Comments