MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9b281a8220a6098fefe1abd6de4fc126fddfa4f08ed1b90d15c9e0514d77e166. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gozi

Vendor detections: 3

Intelligence 3 IOCs YARA File information Comments

SHA256 hash:	9b281a8220a6098fefe1abd6de4fc126fddfa4f08ed1b90d15c9e0514d77e166
SHA3-384 hash:	8707651671bf2613b73bf9f2a08e426f72f14af364007f982e270a0b35bcc95bc9f4550cc97d5f6d95c77a35205c2c6b
SHA1 hash:	8010bf81c3acb3d45f2f51dd153aad16fd5f2e34
MD5 hash:	8f1c25c81a61dc6d7e0ed8066436add5
humanhash:	comet-angel-nitrogen-spaghetti
File name:	temp.dll
Download:	download sample
Signature	Gozi Create hunting rule
File size:	486'400 bytes
First seen:	2020-03-27 08:40:03 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	b1e3beffc1374f78464766065806fbc0 (1 x Gozi)
ssdeep	12288:1cUEHOXAose/Sxc0cSZHLWsh1M0w8q2MyOyvqdZZ9oJ:1c7HOQcRXSZrJm0ZvMdyvMZPc
Threatray	57 similar samples on MalwareBazaar
TLSH	5CA48D01BA61C039F0A616F98DA6D3E89538BE605F3585CB72C43E9F66346E5EC30763
Reporter	abuse_ch
Tags:	dll Gozi ZLoader

abuse_ch

Password protected ZIP->DOC->DLL (ZLoader)

ZLoader C2s:
http://botiq.xyz/milagrecf.php
http://vfgthujbxd.xyz/milagrecf.php
http://wgyvjbse.pw/milagrecf.php

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

PUA.Win.Downloader.Aiis-6803892-0

Gathering data

Threat name:

Win32.Trojan.Kryptik

Status:

Malicious

First seen:

2020-03-26 23:05:00 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

25 of 31 (80.65%)

Threat level:

5/5

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

ZLoader

doc 62ecc8950e8be104e250304fdc32748fcadaeaa677f7c066be1baa17f940eda8

Gozi

DLL dll 9b281a8220a6098fefe1abd6de4fc126fddfa4f08ed1b90d15c9e0514d77e166

(this sample)

Link

https://www.malware-traffic-analysis.net/2020/03/26/index.html

https://twitter.com/malware_traffic/status/1243301158002855938

Dropped by

MD5 067a81a0426dcefee0869b05ad6786a2

Dropped by

SHA256 62ecc8950e8be104e250304fdc32748fcadaeaa677f7c066be1baa17f940eda8

Delivery method

Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryExW KERNEL32.dll::LoadLibraryExA KERNEL32.dll::GetSystemInfo KERNEL32.dll::GetStartupInfoW KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleCP KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileW KERNEL32.dll::GetSystemDirectoryA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample