MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ac6a11ecf700dafee430abe06d62b96a2180f08b1b83b7128e2b9bcab1d67959. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ac6a11ecf700dafee430abe06d62b96a2180f08b1b83b7128e2b9bcab1d67959
SHA3-384 hash:	679d91e932e08425c6b61fe4759f147cb0d1d3a80c69bec2f57ebf67d92879dd2d774fbdd6a8e65ce58bb5ed263dff4e
SHA1 hash:	1e07e548668918d5db3c7b907ad765f2996ff5c5
MD5 hash:	3b69cd2054a8234939a684ed60b7d671
humanhash:	uranus-fifteen-uniform-princess
File name:	ac6a11ecf700dafee430abe06d62b96a2180f08b1b83b7128e2b9bcab1d67959
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	723'301 bytes
First seen:	2023-03-29 23:19:11 UTC
Last seen:	2023-03-30 08:42:22 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	afb90fe87929848463a7c6f2fd59415c (1 x Gozi)
ssdeep	3072:XGMvz842hp4xCCIaBCpGkWSkx0cf5P0UGwS+9BNmA6a:Xtx2yBCiSkxPNT7Ya
TLSH	T190F40EC482BF7D17DC215E3F456A01E073798497B78D4287D8C49939AB7D122AECE2AC
TrID	41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 26.1% (.EXE) Win64 Executable (generic) (10523/12/4) 12.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.1% (.ICL) Windows Icons Library (generic) (2059/9) 5.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	10b064ca969cc960 (1 x Gozi)
Reporter	Anonymous
Tags:	exe Gozi Ursnif

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

410

Origin country :

US

Vendor Threat Intelligence

ANY.RUN

Malware family:

n/a

ID:

1

File name:

ac6a11ecf700dafee430abe06d62b96a2180f08b1b83b7128e2b9bcab1d67959

Verdict:

No threats detected

Analysis date:

2023-03-29 23:19:52 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/bb94f29a-4090-4e30-acf4-789f4450229f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/378613/

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Сreating synchronization primitives

DNS request

Sending a custom TCP request

Sending an HTTP GET request

Running batch commands

Launching a process

Creating a file in the %temp% directory

Launching the process to interact with network services

Certego Dragonfly Suspicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/75654/overview

Behaviour

MalwareBazaar

SystemUptime

MeasuringTime

EvasionQueryPerformanceCounter

EvasionGetTickCount

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug gozi overlay spyeye

Link:

https://www.filescan.io/uploads/6424c7a3688c0e6397b39296/reports/6f61dc60-c33b-47eb-9aed-b3e7ade39e46/overview

Hybrid Analysis HVM:Trojan/W64.Emotet

Verdict:

Suspicious

Labled as:

HVM:Trojan/W64.Emotet

Link:

https://www.hybrid-analysis.com/sample/ac6a11ecf700dafee430abe06d62b96a2180f08b1b83b7128e2b9bcab1d67959

Intezer Suspicious

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/f69cdc61-59c5-4cab-b65e-0721624d9824

Joe Sandbox Bazar Loader, Ursnif

Result

Threat name:

Bazar Loader, Ursnif

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/1204765

Signature

Early bird code injection technique detected

Multi AV Scanner detection for submitted file

Queues an APC in another process (thread injection)

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Bazar Loader

Yara detected Ursnif

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ac6a11ecf700dafee430abe06d62b96a2180f08b1b83b7128e2b9bcab1d67959/

ReversingLabs TitaniumCloud Win64.Trojan.Ursnif

Threat name:

Win64.Trojan.Ursnif

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-03-29 23:20:09 UTC

File Type:

PE+ (Dll)

Extracted files:

806

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vrvbd3hxadnp5zbqvpqg2yvzniqyb4eldob3oeuofon4vmowpfmq._file

Hatching Triage gozi

Result

Malware family:

gozi

Alert

Create hunting rule

Score:

  10/10

Tags:

family:gozi botnet:1000 banker ldr4 trojan

Link:

https://tria.ge/reports/230329-3bd9vaac47/

Behaviour

Runs net.exe

Suspicious use of WriteProcessMemory

Program crash

Gozi

Malware Config

C2 Extraction:

https://ceredovza.top

UnpacMe 2

Unpacked files

SH256 hash:

217bfc6e9f6e8a0aff773cd55510eea84deae5162ad7a97388d2a1fd081b1f33

MD5 hash:

2aada984311db7c34cd9cc3ceacca72e

SHA1 hash:

2b7286ac82463579418dc46d45528e37725d4ffd

Link:

https://www.unpac.me/results/cc20ef74-948b-4b61-bb6b-8db06f0e4cdf/

SH256 hash:

ac6a11ecf700dafee430abe06d62b96a2180f08b1b83b7128e2b9bcab1d67959

MD5 hash:

3b69cd2054a8234939a684ed60b7d671

SHA1 hash:

1e07e548668918d5db3c7b907ad765f2996ff5c5

Link:

https://www.unpac.me/results/cc20ef74-948b-4b61-bb6b-8db06f0e4cdf/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ac6a11ecf700dafee430abe06d62b96a2180f08b1b83b7128e2b9bcab1d67959

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/378613/