MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b97cfd0ea14f390894948861cacafbad2f88767d52477e339e2c0a6e4316793b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b97cfd0ea14f390894948861cacafbad2f88767d52477e339e2c0a6e4316793b
SHA3-384 hash:	826ff4475ec13fd8ea252fa815b6c061058fb84ebe041cc1c3ea4a74bc9299743af90e377579fbd399c0e8f76701d134
SHA1 hash:	34d67f89115124d042f65cff8f16a5508e8336c3
MD5 hash:	0fcb834306b465d8998c654a5d4c3727
humanhash:	utah-salami-white-september
File name:	server.exe
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	182'272 bytes
First seen:	2023-03-20 13:45:57 UTC
Last seen:	2023-03-20 13:47:07 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	b6299cf22bb1b2b906c76a98a991dd84 (5 x Smoke Loader, 5 x RedLineStealer, 2 x Gozi)
ssdeep	3072:2bKsm0/YwL+NqvT+u8TEaYDSj6krWt+3j4XBps2Q:d30QO+udabGTEw
Threatray	84 similar samples on MalwareBazaar
TLSH	T154049ED2A2D0BC52E4128A36CE2FC2F4770DF991CE5DA766E3186B5F08BC162C56B711
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	10d2c660d0705248 (1 x Gozi)
Reporter	JAMESWT_WT
Tags:	agenziaentrate exe Gozi isfb MEF mise Ursnif

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

255

Origin country :

IT

Vendor Threat Intelligence

ANY.RUN Suspicious

Malware family:

n/a

ID:

1

File name:

server.exe

Verdict:

Suspicious activity

Analysis date:

2023-03-20 13:47:26 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/e82ee1dd-fd9b-4e72-955a-0d7bda782a6f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/375951/

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Using the Windows Management Instrumentation requests

DNS request

Sending a custom TCP request

Launching a process

Сreating synchronization primitives

Searching for synchronization primitives

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

80%

Tags:

greyware lockbit packed

Link:

https://www.filescan.io/uploads/6418639fe78a9d3042995cd4/reports/5482aed0-adb8-4ea0-9d08-84b5a7603007/overview

Hybrid Analysis Malware

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/b97cfd0ea14f390894948861cacafbad2f88767d52477e339e2c0a6e4316793b

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Ursnif

Malware family:

Ursnif

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/1ce4356e-3ee3-47b3-a9f3-f32c5489cc29

Joe Sandbox Ursnif

Result

Threat name:

Ursnif

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1197722

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found API chain indicative of debugger detection

Found evasive API chain (may stop execution after checking system information)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Writes or reads registry keys via WMI

Writes registry values via WMI

Yara detected Ursnif

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB gozi

Detection:

gozi

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/b97cfd0ea14f390894948861cacafbad2f88767d52477e339e2c0a6e4316793b/

ReversingLabs TitaniumCloud Win32.Trojan.RedLineStealer

Threat name:

Win32.Trojan.RedLineStealer

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-03-20 13:46:10 UTC

File Type:

PE (Exe)

Extracted files:

29

AV detection:

20 of 24 (83.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xf6p2dvbj44qrfeurbq4vsx3vuxyq5t5kjdx4m46fqfg4qywpe5q._file

Threatray gozi

Verdict:

malicious

Label(s):

gozi

Alert

Create hunting rule

Similar samples:

06368bfb7696a9a950fd2dd365ca585d4fca5b5169e1afef0f4fa3255824b7b8

Gozi

0fa7c98d793b8c71d6ba29bde4fd449e497b246f92ab30403330fae3d8cb6ffd

Gozi

20910e1e303f898ee89a9251651bdae3a328ca1b126d1a7efc31b63b14165f9f

Gozi

3aa75da2773573786f07530f5a09b8e0aacd0402fd11e14d8067b5f4607bbd6a

Gozi

46ae2fec806057df587b5b6a538e811957c74379d5811c6c5cdc8ef06f8fa299

Gozi

8cd2e380a79b34d7993448cdbd73eb2474230de4297aa5239513504011d89933

Gozi

9d1e71b94eab825c928377e93377feb62e02a85b7d750b883919207119a56e0d

Gozi

a9934cc506821e82237fdaf471f845e1e027b37841d635f971b8df6853e9d7f9

Gozi

e0823b70e929019a89c0e0707b6436325517df7bd14e044abd9d1e6d6cfdb10a

Gozi

e514a9ccbd50324a5c54cdf52fc06ddaa7d6c7e21e80ad9ba105314010762a71

Gozi

+ 74 additional samples on MalwareBazaar

Hatching Triage gozi

Result

Malware family:

gozi

Alert

Create hunting rule

Score:

  10/10

Tags:

family:gozi botnet:7715 banker isfb trojan

Link:

https://tria.ge/reports/230320-q2zbgsdg45/

Behaviour

Gozi

Malware Config

C2 Extraction:

checklist.skype.com
62.173.142.81
193.233.175.113
109.248.11.184
212.109.218.26
185.68.93.7

UnpacMe ISFB_Main win_isfb_auto

Unpacked files

SH256 hash:

c817c7b9f76c27fd90036b3b97784d922d6807169083adab7e218eb3df087945

MD5 hash:

d12d8721c6a233f0f65ab81c09422842

SHA1 hash:

8e5903a416826333c6aebd86f995e3fe7ff748b8

Link:

https://www.unpac.me/results/97cefc63-92c3-41bb-9f7f-70dfff31fa0e/

SH256 hash:

ba1a5cd9f9c292c667a0d4d577cf66afe813b9fa838752c67ea6363e5b36c841

MD5 hash:

90b6cdfe9896972ccee348859f8e173d

SHA1 hash:

53bce0dabc905d8aa32c9aacfdbf74bf705c8946

Detections:

ISFB_Main

Alert

Create hunting rule

win_isfb_auto

Alert

Create hunting rule

Link:

https://www.unpac.me/results/97cefc63-92c3-41bb-9f7f-70dfff31fa0e/

Parent samples :

a6886a3566a1a98072d67f1aca4a04b5667f97f4df21b2f54d6108293d7c02b7
0fa7c98d793b8c71d6ba29bde4fd449e497b246f92ab30403330fae3d8cb6ffd
3aa75da2773573786f07530f5a09b8e0aacd0402fd11e14d8067b5f4607bbd6a
a9934cc506821e82237fdaf471f845e1e027b37841d635f971b8df6853e9d7f9
b97cfd0ea14f390894948861cacafbad2f88767d52477e339e2c0a6e4316793b
f139bc8f71a483ba058e2577ef5952b85a74cebd302632a121e4bbc0d96bb953
308110773533c5740fd92d77094da83152f98230cd9635bc8f7dcd7dce910c75

SH256 hash:

b97cfd0ea14f390894948861cacafbad2f88767d52477e339e2c0a6e4316793b

MD5 hash:

0fcb834306b465d8998c654a5d4c3727

SHA1 hash:

34d67f89115124d042f65cff8f16a5508e8336c3

Link:

https://www.unpac.me/results/97cefc63-92c3-41bb-9f7f-70dfff31fa0e/

VMRay Ursnif

Malware family:

Ursnif

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/b97cfd0ea14f/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b97cfd0ea14f390894948861cacafbad2f88767d52477e339e2c0a6e4316793b

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/375951/