MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af428d745dcd02eddb036ee2dbba01665b5331493ba16344f5fa1b0bb1aaa616. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: af428d745dcd02eddb036ee2dbba01665b5331493ba16344f5fa1b0bb1aaa616
SHA3-384 hash: db633a764c8fee2a328bf923ffbab3a9c4ec02d06a1b9edc79fa6e65c872f1a3c43a1835f3cd57988b8d3f18f51993b3
SHA1 hash: 1e9d20874bb38260c0ad973502c03404684c5004
MD5 hash: bc776b95afdb0acf141f072f98db9eb3
humanhash: johnny-gee-sodium-purple
File name:942247.dll
Download: download sample
Signature Gozi
Create hunting rule
File size:561'152 bytes
First seen:2020-06-01 20:20:24 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 8995342755b3dbc4fbfb19b0d7f7ffcf (1 x Gozi)
ssdeep 12288:CMy5gCnxs8QcNBW4Sk/ZBnUMCmZWxLBBNtaz+o:S5gh8LW4ZDWRnCz+o
Threatray 86 similar samples on MalwareBazaar
TLSH EDC4AE05B791D028F5B722F88EBE92A9993D7DA01B24C4CB22C46AEF55255F1EC30737
Reporter abuse_ch
Tags:dll Dridex Gozi

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Frs
Create hunting rule
Status:
Malicious
First seen:
2020-06-01 20:36:22 UTC
AV detection:
15 of 31 (48.39%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
07b339201b9b88b2f43d68584a102fe3c84ab0393e5869357c0b8d08367cc291
Gozi
11d14048cb74288cda1a77e860fb1a9f0b150e33f10080cce8f691c9c4e949e8
Gozi
3110ca3a3f271be4e055a24fb49ae3f35646cea6f99d356ea6672a3f705dcbb5
Gozi
500be83e6624af2302e45bc91e026b776d72824cf84896839e03251c41394110
Gozi
5f68e13f8bf051e68782ba9f3d67555b3b8ca8d8b06b9d6b98c5c45c7217b1e3
Gozi
9bd1a0c0564ae97f2b7c62d392fe749fe2459e1b0f16e2aa0625547b411d1a7a
Gozi
d3e9f6933d519b6bd1514ceaaa14df64722214c0c6c2a60a6924c92f284b3c08
Gozi
df24b965e541f833d891035d6413afa250824f0961dcd6080732b175d3057495
Gozi
e894ace959ac95fda393105d2905b0668ad93781c04be83f9f41fdf38edc1cbc
Gozi
f8bcbdcee35ecafe53c58b8a35bf93db799e7a42136ecb7332d636745744c400
Gozi
+ 76 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet discovery evasion loader trojan
Link:
https://tria.ge/reports/201109-jkmcewzrax/
Behaviour
Suspicious use of WriteProcessMemory
Checks installed software on the system
Checks whether UAC is enabled
Blacklisted process makes network request
Dridex Loader
Dridex
Malware Config
C2 Extraction:
98.103.204.12:443
178.33.112.255:981
198.46.150.202:4646
188.165.17.91:8443
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Dridex

Excel file xlsx 7a0af8308b9f34d8bceced23b99bca01a60befb8750bd987a91ccf7dc7721357

Gozi

DLL dll af428d745dcd02eddb036ee2dbba01665b5331493ba16344f5fa1b0bb1aaa616

(this sample)

  
Dropped by
MD5 6f9784fe699d93d5b39ca0f45e8d2c9e
  
Dropped by
SHA256 7a0af8308b9f34d8bceced23b99bca01a60befb8750bd987a91ccf7dc7721357
  
Delivery method
Distributed via web download

Comments