MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a42fad7a44006d21404affed1fb90a67ecf5e2bc6436dc3729705ca29b4f91e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 13


Intelligence 13 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a42fad7a44006d21404affed1fb90a67ecf5e2bc6436dc3729705ca29b4f91e4
SHA3-384 hash: 0c128989d31411ebbc81b5f21fdde5062e9d14d9c396c5c0f53720f9b41157f3ef250a28854732e37546d4018e55f328
SHA1 hash: bc7db9bff284dc162af5945d849b76fccbd25125
MD5 hash: 4f65e575df96122bbce04e538e531d5e
humanhash: glucose-stairway-zebra-apart
File name:unpacked_gozi.bin
Download: download sample
Signature Gozi
Create hunting rule
File size:44'544 bytes
First seen:2023-02-09 13:33:33 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash ef075d26b728b78a932306e24062e80c (7 x Gozi)
ssdeep 768:/0gsqVXye2rS/Q4VYXQIVpCHlNBmQWGk2j+A6ewBvu7gpzhK3D1Gcb:/9sq8S/QEYXQIVWlvmYp6ewNu7hD1Gc
TLSH T1B3139E01F6F948F6C7A31EB06720FBA9A7F9D631217C5151AF2369CA1E60953E13D20B
TrID 30.2% (.EXE) Win64 Executable (generic) (10523/12/4)
18.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
14.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
12.9% (.EXE) Win32 Executable (generic) (4505/5/1)
5.9% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter Viuleeenz
Tags:agenziaentrate dll Gozi unpacked Ursnif

Intelligence

File Origin
# of uploads :
1
# of downloads :
219
Origin country :
IT IT
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/362798/
Detection(s):
Win.Malware.Ursnif-9975502-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware packed shell32.dll ursnif
Link:
https://www.filescan.io/uploads/63e4f64bfc49e4bf1c31b03b/reports/7cd96ae3-074b-4384-bde7-4ecce35c77b9/overview
Verdict:
Malicious
Labled as:
Ursnif.1.Generic
Link:
https://www.hybrid-analysis.com/sample/a42fad7a44006d21404affed1fb90a67ecf5e2bc6436dc3729705ca29b4f91e4
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Ursnif
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/cb606db6-4417-453f-a681-30719684d326
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1170071
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 802861 Sample: unpacked_gozi.bin.dll Startdate: 09/02/2023 Architecture: WINDOWS Score: 68 15 Malicious sample detected (through community Yara rule) 2->15 17 Antivirus / Scanner detection for submitted sample 2->17 19 Multi AV Scanner detection for submitted file 2->19 21 Machine Learning detection for sample 2->21 7 loaddll32.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        11 conhost.exe 7->11         started        process5 13 rundll32.exe 9->13         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a42fad7a44006d21404affed1fb90a67ecf5e2bc6436dc3729705ca29b4f91e4/
Threat name:
Win32.Trojan.Ursnif
Create hunting rule
Status:
Malicious
First seen:
2023-02-09 13:34:05 UTC
File Type:
PE (Dll)
AV detection:
24 of 26 (92.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uqx226seabwscqck77wr7oikm7wplyv4mq3nynzjobokfg2pshsa._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Result
Malware family:
gozi
Create hunting rule
Score:
  10/10
Tags:
family:gozi botnet:7708 isfb
Link:
https://tria.ge/reports/230209-qt4agadh82/
Behaviour
Suspicious use of WriteProcessMemory
Malware Config
C2 Extraction:
checklist.skype.com
62.173.147.156
31.41.44.3
46.8.19.140
45.151.232.3
62.173.139.21
185.142.99.47
31.41.44.121
Unpacked files
SH256 hash:
a42fad7a44006d21404affed1fb90a67ecf5e2bc6436dc3729705ca29b4f91e4
MD5 hash:
4f65e575df96122bbce04e538e531d5e
SHA1 hash:
bc7db9bff284dc162af5945d849b76fccbd25125
Detections:
ISFB_Main
Create hunting rule
win_isfb_auto
Create hunting rule
Link:
https://www.unpac.me/results/feb9c48e-d1bc-4ff3-9e6f-4bc26ad60a40/
Parent samples :
dcc33bc510228ff4cf4dc286e5902be5a262e3def4189960c702d27b83da84b2
a42fad7a44006d21404affed1fb90a67ecf5e2bc6436dc3729705ca29b4f91e4
df9bc10545b7066ec3bc8868a9e20379aa9a7cbb38928902520eea8fdd3ac2a7
c5a2cc51593e55744e3743c9e1e960a3c96f211555b38d3f4cd340f847206166
84908c9c014c59a36369a618dfc51316646d1dbc3314da3c66100b0706567d22
b076b5edd0ef7e143caf5507aa8d946a93ef4d63ab036887a36ff619ad7223e2
cff404581196accfce86e8ba7a5b8f63b686ef831e384d95e46a04f908e0987a
cedb5a3c5c020cafc8082c1d61b1c8d3d8dd21a7f9c56d2eb581da3fe6486dbe
42978b12f0f6a35808049532ca02a2cbbd0181bc71d6c8525a7a4d2c4861ee4a
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a42fad7a44006d21404affed1fb90a67ecf5e2bc6436dc3729705ca29b4f91e4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_isfb_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.isfb.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/362798/

Comments