MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9d40d8e5b54507f1e857aaa2c16fd22b7e3eb3c87a72d33a649bd9bc382a21b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gozi

Vendor detections: 11

Intelligence 11 IOCs YARA 6 File information Comments

SHA256 hash:	9d40d8e5b54507f1e857aaa2c16fd22b7e3eb3c87a72d33a649bd9bc382a21b4
SHA3-384 hash:	72dd3bf7322daa5d33ee201bbc66828b16320ce8c7d659eddeeeffdfdd12cdde23c0556180e9960b154a44ee4b07e877
SHA1 hash:	0f1a719312f55f9955ab5f04f34e9127297aec09
MD5 hash:	ad4385d58755109a4435e89456dcccfd
humanhash:	undress-timing-ten-butter
File name:	ad4385d58755109a4435e89456dcccfd.exe
Download:	download sample
Signature	Gozi Create hunting rule
File size:	286'208 bytes
First seen:	2021-02-27 06:47:58 UTC
Last seen:	2021-02-27 09:04:13 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	2d633c90a037b9b98e525e48499acae6 (1 x RaccoonStealer, 1 x Gozi)
ssdeep	6144:GxvDLnl9ikbsZzHA2h1Yki77nC2mxyfA4ui:GpDLnl9irHnYR7LC27A
TLSH	53546C10A7F0C837F6F756B849B593B8A53A7AA26720B0CF12D416DD5A346E0BC32717
Reporter	abuse_ch
Tags:	exe Gozi

abuse_ch

Gozi C2:
http://darwikalldkkalsld.xyz

Intelligence

File Origin

# of uploads :

# of downloads :

200

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

ad4385d58755109a4435e89456dcccfd.exe

Verdict:

No threats detected

Analysis date:

2021-02-27 06:50:54 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/3db0f684-e164-41d4-8266-c78760e11c7b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Ursnif3

Link:

https://www.capesandbox.com/analysis/119569/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware1.21444.29968.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Sending a UDP request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/620330

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

isfb

Link:

https://mwdb.cert.pl/sample/9d40d8e5b54507f1e857aaa2c16fd22b7e3eb3c87a72d33a649bd9bc382a21b4/

Threat name:

Win32.Backdoor.Mokes

Status:

Malicious

First seen:

2021-02-26 20:20:57 UTC

AV detection:

15 of 48 (31.25%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=tvanrznviud7d2cxvkrmc36sfn7d5m6ipjzngotetpm3yobkeg2a._file

Result

Malware family:

gozi_ifsb

Score:

10/10

Tags:

family:gozi_ifsb botnet:6565 banker trojan

Link:

https://tria.ge/reports/210227-d242xbbvna/

Behaviour

Gozi, Gozi IFSB

Malware Config

C2 Extraction:

updates.microsoft.com
klounisoronws.xyz
darwikalldkkalsld.xyz

Unpacked files

SH256 hash:

ba63c14d0972a3bed8b8813954b4ddeaa8ef733afac9ed3a86372bfc87a2aa97

MD5 hash:

01bbf9a59beeb52288bdec21980db6e7

SHA1 hash:

ca85f5df9b2572f5a1606eeabee646dc871a9712

Detections:

win_isfb_auto

Link:

https://www.unpac.me/results/560057d6-e5ed-4f44-ac45-36c635624896/

Parent samples :

77e3afaec1b7b091e7f1fd3bbfac6aa65216e60d6b6f3c866304913278470f61
33b931c8f19d3ef8b354cc7ca24ebfbb2cdf2b83e5717b1dd7c81cef80238591
9d40d8e5b54507f1e857aaa2c16fd22b7e3eb3c87a72d33a649bd9bc382a21b4
e789b72e2160d3c51e6ab89c99d8bb1075f380f875e8a7bfc8dae20eff3e8388
f7c8f22c944ad9bcf149348cbbe8f404fc69b58fe15977245fc2413f6e327e09
267d3265b48b05aeb6ea82ca0f6ba1766108ecab9d7e2a5803c92ea055c53428
1592f542473e48b5a4ceac2f276254d0e8c4c7f820e500979f2a787bb6e32507

SH256 hash:

02b4f54ebc6a5063943586f6bc40758e131dadaf172ea93a3f0502e4f2482a1a

MD5 hash:

d072126a30f961dcf578e340676c209a

SHA1 hash:

bbcde8fc82afefc4aacdc5a99ac4ddc70278276e

Link:

https://www.unpac.me/results/560057d6-e5ed-4f44-ac45-36c635624896/

SH256 hash:

9d40d8e5b54507f1e857aaa2c16fd22b7e3eb3c87a72d33a649bd9bc382a21b4

MD5 hash:

ad4385d58755109a4435e89456dcccfd

SHA1 hash:

0f1a719312f55f9955ab5f04f34e9127297aec09

Link:

https://www.unpac.me/results/560057d6-e5ed-4f44-ac45-36c635624896/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9d40d8e5b54507f1e857aaa2c16fd22b7e3eb3c87a72d33a649bd9bc382a21b4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Email_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Email in files like avemaria

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients Create hunting rule
Author:	@ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	Ursnif Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Ursnif(a.k.a. Dreambot, Gozi, ISFB) in memory
Reference:	internal research

Rule name:	Ursnif3 Create hunting rule
Author:	kevoreilly
Description:	Ursnif Payload

Rule name:	win_dreambot_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

Rule name:	win_isfb_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator