🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a548ac73d6acb5a260cb2e1760946c37ce94d89f3cd2a5b126e266e007dfc543. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a548ac73d6acb5a260cb2e1760946c37ce94d89f3cd2a5b126e266e007dfc543
SHA3-384 hash: fa63e9b5baed72d224217452dc19cd6f439820030c2bf54f9d1c7547fadfccc662f5f3687c22227a1325bf78b7ca5753
SHA1 hash: 6288e611de585a6dc56c6399ef03012698d60392
MD5 hash: 9f3b8462c508884f6966f3ad4a275799
humanhash: hotel-eleven-uniform-burger
File name:9f3b8462c508884f6966f3ad4a275799.exe
Download: download sample
Signature Gozi
Create hunting rule
File size:298'496 bytes
First seen:2021-11-24 17:17:22 UTC
Last seen:2021-11-24 18:51:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 62f526399c5bc6ba1d2354b3cc3131f3 (2 x Gozi, 1 x FickerStealer, 1 x Smoke Loader)
ssdeep 6144:0fcUtwkDhJYbsB/qMZSXuZet0yyen73jF20+Mpbz/CyU:0U2n1B/3ZSXuZet0yye7w0+MpC
Threatray 519 similar samples on MalwareBazaar
TLSH T141549F00B7A0C435F1B756F889B9D3B9693FB9A16B2891CB52D116EA57356E0EC3030B
File icon (PE):PE icon
dhash icon e0e8e8e8aa66a489 (8 x RaccoonStealer, 6 x RedLineStealer, 2 x Tofsee)
Reporter abuse_ch
Tags:exe Gozi

Intelligence

File Origin
# of uploads :
2
# of downloads :
365
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
9f3b8462c508884f6966f3ad4a275799.exe
Verdict:
Suspicious activity
Analysis date:
2021-11-24 21:40:08 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/766250d6-ecb5-41c9-95df-fef31f3a0c35

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Detection(s):
SecuriteInfo.com.Variant.Jaik.49513.1469.18014.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/619e73cdf36138de3f3a3669/reports/6bf98891-6c58-4b8f-8a80-29bb2e2ca290/overview
Malware family:
Ursnif
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2bad8633-861e-4a8d-82ff-a3fccc1355dd
Result
Threat name:
Ursnif
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/895593
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Writes or reads registry keys via WMI
Writes registry values via WMI
Yara detected Ursnif
Behaviour
Behavior Graph:
Download SVG
Detection:
gozi
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a548ac73d6acb5a260cb2e1760946c37ce94d89f3cd2a5b126e266e007dfc543/
Threat name:
Win32.Trojan.Azorult
Create hunting rule
Status:
Malicious
First seen:
2021-11-24 03:43:41 UTC
File Type:
PE (Exe)
Extracted files:
14
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uveky46wvs22eyglfylwbfdmg7hjjwe7htjklmjg4jtoab67yvbq._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
0a3bc15ceb80f700d80b7d651ff378cf407c239f3e513e3bc9bd854f82f7e22c
Gozi
0f54e3a74da4ee2efba60740d755ae9764d9ba2327cd1f2b5c9ba55a8051745d
Gozi
34cdedc14043c6a708dbc123fb6c4b1f6f7411eae704c4a125ca7128d266345d
Gozi
a181b562122fb3752137474073f22e1b2b1b4cc82a5269e73847a0e2e212cd56
Gozi
a5540f6dd0f7761dd3f7e52f5e1d25332b99d95cccf63401d202406160948750
Gozi
ceba6a7f9a2c25a35090470c6209aefed808786c47194a18415a7898390c20cb
Gozi
e4a5317a1b7c1ab91bb131dba5fea06fdb89e38c291e17f71b5c1634cfddecbe
Gozi
+ 509 additional samples on MalwareBazaar
Result
Malware family:
gozi_ifsb
Create hunting rule
Score:
  10/10
Tags:
family:gozi_ifsb botnet:4482 banker trojan
Link:
https://tria.ge/reports/211124-vt9jpsgdh5/
Behaviour
Gozi, Gozi IFSB
Malware Config
C2 Extraction:
yahoo.com
soderunovos.website
qoderunovos.website
https://soderunovos.website
https://qoderunovos.website
Unpacked files
SH256 hash:
1496db8c1485c2d299e63a92ad4034dde58d65e7ac0d9be5f88eceacc0110550
MD5 hash:
da9fd768080af3bd5355488bb0f01af0
SHA1 hash:
d2872077343a233923964d47c90945d047666daf
Link:
https://www.unpac.me/results/ec721cea-5ed6-4c1c-8305-41fe8933c6b2/
SH256 hash:
17797130ef106e4ff3ae555beef7f4bd5ec2c9ee65b2d3a12208a129de10193b
MD5 hash:
8fd5daefb7f64468797d94ffac9c111f
SHA1 hash:
a517026d832f96a39f1939f56c4ceea9072d963e
Detections:
win_isfb_auto
Create hunting rule
Link:
https://www.unpac.me/results/ec721cea-5ed6-4c1c-8305-41fe8933c6b2/
Parent samples :
4c50ff0945136ff0f79eb75ee7d5c86025282ab519488f692ffc267873160bb6
440c297bcaa0e4ca3d84281d524b8351ad1ea2b5aabb22795db824a356cd54bd
a548ac73d6acb5a260cb2e1760946c37ce94d89f3cd2a5b126e266e007dfc543
c26838865c476704101363c16c535dfae494dedadae972c0377c4f67669578b5
SH256 hash:
1b54565514d9f960716ed0230dd5c9cba57e52a7af663950e8562acd9255714b
MD5 hash:
47c443d32b78aab61eebb191e8f55e1b
SHA1 hash:
951cc4ef87566794edfc11a0ae7ef63aa8afd04c
Detections:
win_isfb_auto
Create hunting rule
Link:
https://www.unpac.me/results/ec721cea-5ed6-4c1c-8305-41fe8933c6b2/
Parent samples :
4c50ff0945136ff0f79eb75ee7d5c86025282ab519488f692ffc267873160bb6
440c297bcaa0e4ca3d84281d524b8351ad1ea2b5aabb22795db824a356cd54bd
a548ac73d6acb5a260cb2e1760946c37ce94d89f3cd2a5b126e266e007dfc543
c26838865c476704101363c16c535dfae494dedadae972c0377c4f67669578b5
SH256 hash:
a548ac73d6acb5a260cb2e1760946c37ce94d89f3cd2a5b126e266e007dfc543
MD5 hash:
9f3b8462c508884f6966f3ad4a275799
SHA1 hash:
6288e611de585a6dc56c6399ef03012698d60392
Link:
https://www.unpac.me/results/ec721cea-5ed6-4c1c-8305-41fe8933c6b2/
Malware family:
Ursnif
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/a548ac73d6ac/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a548ac73d6acb5a260cb2e1760946c37ce94d89f3cd2a5b126e266e007dfc543

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ursnif3
Create hunting rule
Author:kevoreilly
Description:Ursnif Payload
Rule name:win_isfb_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.isfb.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/209072/

Comments