MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bce0ea4a85e5bc6af2dfe91b1ceef3416f210aa4f5c9cf8e6adf1b7f4aacf874. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bce0ea4a85e5bc6af2dfe91b1ceef3416f210aa4f5c9cf8e6adf1b7f4aacf874
SHA3-384 hash: 84b50df75e19fab17d032e6c7e3cb2395d3e3932095030a19d183f02461744e495cb3d28ab6ea49e847f1020c65f0a95
SHA1 hash: 83887ebf7e43dd55ac2964d4db2e1ac6107cede3
MD5 hash: 743bf0cc1becee9274e66f108753c23a
humanhash: florida-november-nitrogen-robin
File name:1efaace0000.dll
Download: download sample
Signature Gozi
Create hunting rule
File size:262'144 bytes
First seen:2022-03-15 14:59:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 6144:3jOc9lLYJm9qCR8h2O1CCP1GzzBpbf76mWtM55jKMu:339VYJj0g2eCCP1GzzT7BWt3
Threatray 25 similar samples on MalwareBazaar
TLSH T165447D5AA3E50D95E9BBC5B9CD93D217DBF234091A60D34F52B4CE9A6F03722B21C342
Reporter 0x746f6d6669
Tags:exe Gozi

Intelligence

File Origin
# of uploads :
1
# of downloads :
262
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
1efaace0000.dll
Verdict:
No threats detected
Analysis date:
2022-03-16 04:54:11 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/531e9ab5-3346-4907-97b6-c4aa35f4106b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/250943/
Detection(s):
Win.Malware.Ursnif-9884005-0
Create hunting rule

Win.Malware.Ursnif-9886559-0
Create hunting rule

Win.Malware.Ursnif-9892796-0
Create hunting rule

Win.Malware.Ursnif-9896448-0
Create hunting rule

Win.Malware.Ursnif-9917123-0
Create hunting rule

Win.Malware.Ursnif-9937854-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed setupapi.dll shell32.dll ursnif
Link:
https://www.filescan.io/uploads/6230a9ffb94fb38cb4859c7f/reports/6a41808f-6b68-4979-a06c-7c4884ec0626/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Ursnif
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/09a71b14-a03e-4630-bbd4-858851e8ddf1
Result
Threat name:
Ursnif
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/957140
Signature
Antivirus / Scanner detection for submitted sample
Found malware configuration
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Call by Ordinal
Yara detected Ursnif
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 589631 Sample: 1efaace0000.dll Startdate: 15/03/2022 Architecture: WINDOWS Score: 76 15 Found malware configuration 2->15 17 Antivirus / Scanner detection for submitted sample 2->17 19 Multi AV Scanner detection for submitted file 2->19 21 2 other signatures 2->21 7 loaddll64.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        11 rundll32.exe 7->11         started        process5 13 rundll32.exe 9->13         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bce0ea4a85e5bc6af2dfe91b1ceef3416f210aa4f5c9cf8e6adf1b7f4aacf874/
Threat name:
Win64.Trojan.Ursnif
Create hunting rule
Status:
Malicious
First seen:
2022-03-15 15:19:56 UTC
AV detection:
21 of 27 (77.78%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
436d6d226550ed2e15292a65859fc41cde7cde6b34e83e10dff0518036cd1787
Gozi
8b5e23b6fec77ca9ef5b22fdbc80ac42d7199c5638b90b45040e0f1038e72b1b
Gozi
93d5291a8c81a426309d688c3b44552824b3dcf4239948154877e895b22de285
Gozi
99acd04fc77abe7829c5fb51638d448efbeb7053aa62aa29412fbc3d1321d569
Gozi
cde070a46442e1a06c722393a335e8c104904a0581d890bf25a13f9c0db39473
Gozi
e40aebcbc975e71e77cd85240d93690a81c876d7045bd9c2284da9dc9ef0efe1
Gozi
fc456d0ac2cfee099478997953f2c7d4e07b47fe32bb109b1a9e40fa6aceb93d
Gozi
+ 15 additional samples on MalwareBazaar
Result
Malware family:
gozi_ifsb
Create hunting rule
Score:
  10/10
Tags:
family:gozi_ifsb botnet:777999
Link:
https://tria.ge/reports/220315-sdbxdsbdan/
Malware Config
C2 Extraction:
config.edge.skype.com
67.43.234.14
67.43.234.37
67.43.234.47
Unpacked files
SH256 hash:
bce0ea4a85e5bc6af2dfe91b1ceef3416f210aa4f5c9cf8e6adf1b7f4aacf874
MD5 hash:
743bf0cc1becee9274e66f108753c23a
SHA1 hash:
83887ebf7e43dd55ac2964d4db2e1ac6107cede3
Link:
https://www.unpac.me/results/a289e06b-b169-4878-a794-ec30cead1bc7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/bce0ea4a85e5bc6af2dfe91b1ceef3416f210aa4f5c9cf8e6adf1b7f4aacf874

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/250943/

Comments