MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 95fe3d0f07525ff8ecdfdc06a302d7bf108d3a1f667d2f84eab36012f7095fc0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	95fe3d0f07525ff8ecdfdc06a302d7bf108d3a1f667d2f84eab36012f7095fc0
SHA3-384 hash:	4585b87ddbdf2e8360af280447bdab797bfbc40351f2b34f8329a56735836755d1497a7bc2e0fced6ee3b22aab7eeb8e
SHA1 hash:	2d9e00175fb50a5571963701e5d2d978e54eb1fd
MD5 hash:	db1ea265479d812282cb08e489e7d67b
humanhash:	papa-cardinal-arizona-florida
File name:	Cliente.zip
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	320 bytes
First seen:	2023-10-09 13:56:33 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	6:5jbbls/zuAynnZ324hJ/ELUwWtT+0d8MHBg8JnBartjblsTSAkOgfgfx+ls:5jbbSqxnn/EQrrHB9Jn4bmSzI5as
TLSH	T1D0E0EB267A0A3CD8C15AF23082975B82DC30BD057DF2C18B0A3AE8CD5FC6BC18F24A00
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	JAMESWT_WT
Tags:	agenziaentrate Gozi isfb Ursnif zip zip 1

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

159

Origin country :

IT

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Cliente.txt
File size:	192 bytes
SHA256 hash:	5a2e65a2871f7cb86d1b37471ca70f1b880f5a53e84769bb89d2040bf4aaec0d
MD5 hash:	410f06f8a3645dfd24e8d66e69af3b57
MIME type:	text/plain
Signature	Gozi

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Win.Exploit.CVE_2023_32046-10006582-1

Alert

Create hunting rule

TwinWave.EvilShortcut.DottedQuadDancingInHeavenZip.20230105.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilShortcut.DottedQuadDancingInHeaven.20230105.UNOFFICIAL

Alert

Create hunting rule

DocGuard Unknown

Result

Verdict:

Unknown

File Type:

ZIP File

Link:

https://app.docguard.net/95fe3d0f07525ff8ecdfdc06a302d7bf108d3a1f667d2f84eab36012f7095fc0/results/dashboard

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/652406af1e07d7e1e9bad05e/reports/fbfdacfc-451c-4dd6-b3c4-225ece067eea/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/95fe3d0f07525ff8ecdfdc06a302d7bf108d3a1f667d2f84eab36012f7095fc0

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/95fe3d0f07525ff8ecdfdc06a302d7bf108d3a1f667d2f84eab36012f7095fc0

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/95fe3d0f07525ff8ecdfdc06a302d7bf108d3a1f667d2f84eab36012f7095fc0/

ReversingLabs TitaniumCloud Shortcut.Trojan.MalLink

Threat name:

Shortcut.Trojan.MalLink

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-10-09 13:57:05 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

3 of 38 (7.89%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=sx7d2dyhkjp7r3g73qdkgawxx4ii2oq7mz6s7bhkwnqbf5yjl7aa._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

n/a

Link:

https://tria.ge/reports/231009-rmav1sfd99/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/95fe3d0f07525ff8ecdfdc06a302d7bf108d3a1f667d2f84eab36012f7095fc0