MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 96defacb7096fc81b809c4b0e427399cb2f7da2fb7eb278dd676785a8a476181. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 96defacb7096fc81b809c4b0e427399cb2f7da2fb7eb278dd676785a8a476181
SHA3-384 hash: 12814d25b10e5eea51f3cd2cbd5f2f0419009ab75aa35d2746f016e2e65f3627feae5eeb166fb5997ddd633bfed8df86
SHA1 hash: 25fc199dbb5a7c0a71dfa8f430d8f09d09c0326d
MD5 hash: c9cd971a083303b1b7c4c912f8739f6b
humanhash: twelve-oklahoma-fish-pip
File name:c9.dll
Download: download sample
Signature Gozi
Create hunting rule
File size:167'426 bytes
First seen:2021-10-07 13:58:44 UTC
Last seen:2021-10-07 15:09:44 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 03950ae48622d89c2d077838afd282e9 (2 x Gozi)
ssdeep 3072:LPt9UofdP4nIFJABRIGM2k0xe2Iy95auD3H8t2YmzQPJbN:DtLdP4QaBaGM2k0xe2T55bQ2PiN
TLSH T180F38D127584E135D72E16344CA7DAB80667BC0057BAEC4B33EF1E9F47A3292F622785
Reporter 0x746f6d6669
Tags:dll Gozi

Intelligence

File Origin
# of uploads :
2
# of downloads :
451
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Ursnif3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/195870/
Detection(s):
SecuriteInfo.com.Trojan.Gozi.777.6081.15425.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/615efd29b95458900cde310e/reports/2832eb3c-9edc-4d8d-aae0-b43585da54f9/overview
Malware family:
Ursnif
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/804f7601-1451-4d08-b957-8ef81528e28a
Result
Threat name:
Ursnif
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/866455
Signature
Antivirus / Scanner detection for submitted sample
Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Writes or reads registry keys via WMI
Writes registry values via WMI
Yara detected Ursnif
Behaviour
Behavior Graph:
Download SVG
Detection:
gozi
Create hunting rule
Link:
https://mwdb.cert.pl/sample/96defacb7096fc81b809c4b0e427399cb2f7da2fb7eb278dd676785a8a476181/
Threat name:
Win32.Trojan.Ursnif
Create hunting rule
Status:
Malicious
First seen:
2021-10-07 13:59:08 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=s3ppvs3qs36idoajysyoijzztszppwrpw7vspdowoz4fvcshmgaq._file
Result
Malware family:
gozi_ifsb
Create hunting rule
Score:
  10/10
Tags:
family:gozi_ifsb botnet:3300 banker trojan
Link:
https://tria.ge/reports/211007-raf69scgaq/
Behaviour
Suspicious use of WriteProcessMemory
Gozi, Gozi IFSB
Malware Config
C2 Extraction:
api10.laptok.at/api1
golang.feel500.at/api1
go.in100k.at/api1
Unpacked files
SH256 hash:
b7a7c7fad1e86305e14008a8ffd4922b3d37b7efaa2bf6acad5b27bd5bf8d924
MD5 hash:
e5128c909beb1626de0029d2b36179a7
SHA1 hash:
ffd80a411525706b2ab55c73cd06d7c0db44a0bb
Detections:
win_isfb_auto
Create hunting rule
Link:
https://www.unpac.me/results/2b5416f7-355c-4e9c-a5af-69dcfb45b35b/
Parent samples :
74cc533238ae33245519b52784db0e6adbd3380b350717fdc69d4e36714173d5
2b8c7b7112e8070d01b2f977c360772e05704fff1838bf124780b9c8b699f337
96defacb7096fc81b809c4b0e427399cb2f7da2fb7eb278dd676785a8a476181
SH256 hash:
96defacb7096fc81b809c4b0e427399cb2f7da2fb7eb278dd676785a8a476181
MD5 hash:
c9cd971a083303b1b7c4c912f8739f6b
SHA1 hash:
25fc199dbb5a7c0a71dfa8f430d8f09d09c0326d
Link:
https://www.unpac.me/results/2b5416f7-355c-4e9c-a5af-69dcfb45b35b/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/96defacb7096/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/96defacb7096fc81b809c4b0e427399cb2f7da2fb7eb278dd676785a8a476181

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ursnif3
Create hunting rule
Author:kevoreilly
Description:Ursnif Payload
Rule name:win_isfb_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.isfb.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/195870/

Comments