🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a6f0ad440063e4aab5a6eab256ead56e4cd9594bc34dcdb273d89dca0f7032d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a6f0ad440063e4aab5a6eab256ead56e4cd9594bc34dcdb273d89dca0f7032d1
SHA3-384 hash: a68625458fbc625b6736f4a10a2fbba05ac100d14f7e7fcbfbcb6b3417a99074bf120417a8afbc809b0c54bcf6ae1883
SHA1 hash: 588cc4fea13fe49d361468dac070e8c2da615e12
MD5 hash: 2bd6e4dddd6dfd7fe24514576f47068c
humanhash: montana-four-lamp-hydrogen
File name:61a60b201df7d.dll
Download: download sample
Signature Gozi
Create hunting rule
File size:43'520 bytes
First seen:2021-11-30 11:30:25 UTC
Last seen:2021-11-30 13:32:05 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 7810ad7e9f1684556ca41a69627e4ce9 (1 x Gozi)
ssdeep 768:PIVWaRYvSzat1U2NwQGh9SoHbxlDJgokunZIlXnSvhrUJot:PIMaCZQh9SQjDJ/ZC3ot
Threatray 570 similar samples on MalwareBazaar
TLSH T15113F1982F1606BDE31BD43F513D62EC636C4261C3E9A8410BE5745FB4EAD1B6D3D222
Reporter JAMESWT_WT
Tags:brt dll Gozi isfb ITA Ursnif

Intelligence

File Origin
# of uploads :
2
# of downloads :
600
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Ursnif3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/209894/
Detection(s):
SecuriteInfo.com.Trojan.Gozi.844.782.19623.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
packed
Link:
https://www.filescan.io/uploads/61a60b78effcae2254f57217/reports/960ecdc8-2014-471f-9414-b2688f514212/overview
Malware family:
Ursnif
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1fd52047-72aa-4b64-befa-af7a716450e4
Result
Threat name:
Ursnif
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/898623
Signature
Antivirus / Scanner detection for submitted sample
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Writes or reads registry keys via WMI
Writes registry values via WMI
Yara detected Ursnif
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 531101 Sample: 61a60b201df7d.dll Startdate: 30/11/2021 Architecture: WINDOWS Score: 100 28 karfaganda.com 2->28 30 bvolebukoneh.site 2->30 64 Found malware configuration 2->64 66 Antivirus / Scanner detection for submitted sample 2->66 68 Multi AV Scanner detection for submitted file 2->68 70 2 other signatures 2->70 8 loaddll32.exe 1 2->8         started        signatures3 process4 dnsIp5 44 bvolebukoneh.site 37.120.206.70, 443, 49867, 49871 M247GB Romania 8->44 46 karfaganda.com 45.9.20.245, 443, 49885, 49886 DEDIPATH-LLCUS Russian Federation 8->46 48 2 other IPs or domains 8->48 74 Writes or reads registry keys via WMI 8->74 76 Writes registry values via WMI 8->76 12 regsvr32.exe 8->12         started        16 cmd.exe 1 8->16         started        18 rundll32.exe 8->18         started        20 iexplore.exe 1 73 8->20         started        signatures6 process7 dnsIp8 50 karfaganda.com 12->50 52 bvolebukoneh.site 12->52 60 2 other IPs or domains 12->60 78 System process connects to network (likely due to code injection or exploit) 12->78 80 Writes or reads registry keys via WMI 12->80 82 Writes registry values via WMI 12->82 22 rundll32.exe 16->22         started        54 karfaganda.com 18->54 56 bvolebukoneh.site 18->56 62 2 other IPs or domains 18->62 58 192.168.2.1 unknown unknown 20->58 26 iexplore.exe 2 152 20->26         started        signatures9 process10 dnsIp11 32 karfaganda.com 22->32 34 bvolebukoneh.site 22->34 40 2 other IPs or domains 22->40 72 Writes registry values via WMI 22->72 36 dart.l.doubleclick.net 216.58.206.38, 443, 49830, 49831 GOOGLEUS United States 26->36 38 ad-delivery.net 104.26.3.70, 443, 49834, 49835 CLOUDFLARENETUS United States 26->38 42 13 other IPs or domains 26->42 signatures12
Detection:
isfb
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a6f0ad440063e4aab5a6eab256ead56e4cd9594bc34dcdb273d89dca0f7032d1/
Threat name:
Win32.Trojan.Ursnif
Create hunting rule
Status:
Malicious
First seen:
2021-11-30 11:31:09 UTC
File Type:
PE (Dll)
AV detection:
24 of 27 (88.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=u3yk2raampskvnng5kzfn2wvnzgnswklyng43mtt3co4ud3qgliq._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
0570fd54d98349e62675cf1e53aa2197ed6c0df811350bfae9f64196b0a49278
Gozi
2f4d76314a00fb7a8047fcdd3ee26c39d2a550cde356d35ae517631392a66e8a
Gozi
43440e9a6d2d0a68b84f7885fda26748fa86de6ca709a883959e2640f3f706bf
Gozi
4e7f81fa970f3c2ffa70c22d10b2c81efbf7429594719be49b56a0b516503e4b
Gozi
5bbba6d13c8222ef2cc5c4aecf14043f1e74d164ab2a1b3e4b68ee6cb086900c
Gozi
9ef7ed2350cf20e7180d5cf9a2e0cf9a8a9298aa472ad50190a9e61689d769b9
Gozi
b82a1d06e5650808ae0b9ef1a77cc6047ca0601b13a9afa8cded17a93e27cda9
Gozi
e5ddae0f09c15a7eaebe71a0ccfcb83ccdd629760b612fffaab46d9a4260e662
Gozi
+ 560 additional samples on MalwareBazaar
Result
Malware family:
gozi_ifsb
Create hunting rule
Score:
  10/10
Tags:
family:gozi_ifsb botnet:8899
Link:
https://tria.ge/reports/211130-nmpsdshhd5/
Behaviour
Suspicious use of WriteProcessMemory
Malware Config
C2 Extraction:
microsoft.com/windowsdisabler
bvolebukoneh.site
karfaganda.com
Unpacked files
SH256 hash:
04c114152940aabda3d171b52e93f6c77f80cf6efb87d23ac21566c4d5760a72
MD5 hash:
aeee1aac84ec69a67bab08ad9f7caf50
SHA1 hash:
6125690fbff62b8bcbe04401296dcfc9d3672edc
Detections:
win_isfb_auto
Create hunting rule
Link:
https://www.unpac.me/results/e5225130-d922-41ed-b721-15d63d22dd6f/
SH256 hash:
a6f0ad440063e4aab5a6eab256ead56e4cd9594bc34dcdb273d89dca0f7032d1
MD5 hash:
2bd6e4dddd6dfd7fe24514576f47068c
SHA1 hash:
588cc4fea13fe49d361468dac070e8c2da615e12
Detections:
win_isfb_auto
Create hunting rule
Link:
https://www.unpac.me/results/e5225130-d922-41ed-b721-15d63d22dd6f/
Parent samples :
a6f0ad440063e4aab5a6eab256ead56e4cd9594bc34dcdb273d89dca0f7032d1
f7d8d6786f0665412998662ed0fe90bb9cf165caf878d236637a055106eeaf9e
Malware family:
Ursnif.IAP
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/a6f0ad440063/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.08
Link:
https://yomi.yoroi.company/submissions/a6f0ad440063e4aab5a6eab256ead56e4cd9594bc34dcdb273d89dca0f7032d1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ursnif3
Create hunting rule
Author:kevoreilly
Description:Ursnif Payload
Rule name:win_isfb_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.isfb.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gozi

DLL dll a6f0ad440063e4aab5a6eab256ead56e4cd9594bc34dcdb273d89dca0f7032d1

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/209894/
  
URLhaus
https://urlhaus.abuse.ch/url/1836309/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1836307/

Comments