🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 abba2df70844fd62241dbb1ec6eb2469e79e7d4834372b92d1cb3bb6f6166afa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: abba2df70844fd62241dbb1ec6eb2469e79e7d4834372b92d1cb3bb6f6166afa
SHA3-384 hash: 9a4f0aa47158a91c155b62507a87532f85684e056e0cb6a04618909fcb6c471c1c804cd8dec36c8fd2a01f6cbcc86dc9
SHA1 hash: a6b6831577f481395e0cf095a1cc0ed1bfbfdfd3
MD5 hash: b60dfd8f0651a895705f77b70637c76c
humanhash: blue-yankee-winner-uniform
File name:svf0ycue.bin
Download: download sample
Signature Gozi
Create hunting rule
File size:3'584 bytes
First seen:2023-09-28 13:41:10 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 62 x CobaltStrike, 44 x JanelaRAT)
ssdeep 48:6TVXE7S5vkUTDXnrWrKJ38zZX1ulza3Pq:r7S5vkUiNeBK
TLSH T12371001A67E80A67F4B707356EF3431327F5FC108FB3571E5A8002196C616284E32BB0
TrID 30.2% (.EXE) Win64 Executable (generic) (10523/12/4)
18.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
14.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
12.9% (.EXE) Win32 Executable (generic) (4505/5/1)
5.9% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter JAMESWT_WT
Tags:agenziaentrate BadInterop dll Gozi Ursnif

Intelligence

File Origin
# of uploads :
1
# of downloads :
360
Origin country :
IT IT
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/451797/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/651582ab49c6a4ce497ef307/reports/8c0741d8-3235-4dcd-942f-798cd96508bc/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/abba2df70844fd62241dbb1ec6eb2469e79e7d4834372b92d1cb3bb6f6166afa
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/9a8648a5-a6db-4958-a4a9-c0c1487db0cc
Result
Threat name:
n/a
Detection:
clean
Classification:
n/a
Score:
3 / 100
Link:
https://www.joesandbox.com/analysis/1315887
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/abba2df70844fd62241dbb1ec6eb2469e79e7d4834372b92d1cb3bb6f6166afa/
Threat name:
Win32.Trojan.Ursnif
Create hunting rule
Status:
Suspicious
First seen:
2023-09-28 13:38:20 UTC
File Type:
PE (.Net Dll)
AV detection:
13 of 23 (56.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vo5c35yiit6weja5xmpmn2zenhtz47kigq3sxewrzm53n5qwnl5a._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230928-qznrzadb29/
Unpacked files
SH256 hash:
abba2df70844fd62241dbb1ec6eb2469e79e7d4834372b92d1cb3bb6f6166afa
MD5 hash:
b60dfd8f0651a895705f77b70637c76c
SHA1 hash:
a6b6831577f481395e0cf095a1cc0ed1bfbfdfd3
Link:
https://www.unpac.me/results/cd4a4d11-4a4c-48e3-8fc2-5584ee6e397f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
ursnif3
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/abba2df70844fd62241dbb1ec6eb2469e79e7d4834372b92d1cb3bb6f6166afa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:extracted_at_0x44b
Create hunting rule
Author:cb
Description:sample - file extracted_at_0x44b.exe
Reference:Internal Research
Rule name:NETDLLMicrosoft
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/451797/

Comments