MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd43f7bc23a76b086a81b8e6fcd4355cac648d3f7d9a941d9aa259def534d5b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bd43f7bc23a76b086a81b8e6fcd4355cac648d3f7d9a941d9aa259def534d5b1
SHA3-384 hash: 34ef17e4c60b447427fc29b093b0f4bfaffd0be26960a35344f99307fb588a8ec081685bc94a8481e2cdfdd22d332a7b
SHA1 hash: 01ea39853139ccfe82f0bd19f8963d3ccebf8e8a
MD5 hash: 18d613d02eaf8d339feebb21f578f329
humanhash: gee-white-berlin-bravo
File name:18d613d02eaf8d339feebb21f578f329.dll
Download: download sample
Signature Gozi
Create hunting rule
File size:523'264 bytes
First seen:2021-05-04 15:30:57 UTC
Last seen:2021-05-04 17:03:13 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 61abfa6d76443dd7d018df0c9cf8b0a5 (2 x Gozi)
ssdeep 12288:CddaT8lLVrp6I7MsfHqWxSWlNTjGoLYTbgOJpXLH:Cddhp1YCMuFx/jGo0XL
Threatray 270 similar samples on MalwareBazaar
TLSH 6CB4CE1131D2C135D16247BE482BEAC147FDBE654F351A9B3AC87B8F2E36092A739712
Reporter abuse_ch
Tags:dll geo Gozi isfb ITA Ursnif

Intelligence

File Origin
# of uploads :
2
# of downloads :
270
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis18D613D02EAF.9689.182.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Using the Windows Management Instrumentation requests
Launching a process
Creating a window
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Searching for the window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Ursnif
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/710453
Signature
Found malware configuration
Writes registry values via WMI
Yara detected Ursnif
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 404149 Sample: iJdlvBxhYu.dll Startdate: 04/05/2021 Architecture: WINDOWS Score: 60 24 outlook.office365.com 2->24 26 outlook.ms-acdc.office.com 2->26 28 2 other IPs or domains 2->28 36 Found malware configuration 2->36 38 Yara detected  Ursnif 2->38 8 loaddll32.exe 1 2->8         started        10 iexplore.exe 1 50 2->10         started        signatures3 process4 process5 12 rundll32.exe 8->12         started        15 cmd.exe 1 8->15         started        17 rundll32.exe 8->17         started        19 iexplore.exe 24 10->19         started        dnsIp6 40 Writes registry values via WMI 12->40 22 rundll32.exe 15->22         started        30 outlook.com 40.97.128.194, 443, 49725, 49726 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 19->30 32 HHN-efz.ms-acdc.office.com 52.97.150.2, 443, 49728, 49729 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 19->32 34 6 other IPs or domains 19->34 signatures7 process8
Detection:
isfb
Create hunting rule
Link:
https://mwdb.cert.pl/sample/bd43f7bc23a76b086a81b8e6fcd4355cac648d3f7d9a941d9aa259def534d5b1/
Threat name:
Win32.Trojan.Ursnif
Create hunting rule
Status:
Malicious
First seen:
2021-05-04 15:31:08 UTC
AV detection:
10 of 47 (21.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xvb7ppbdu5vqq2ubxdtpzvbvlswgjdj7pwnjihm2ujm555ju2wyq._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
43b3014c1627c40c31c724e1a7b1dee4ef51428e2f68adad93c0df95f454275d
Gozi
46b5308d058e2dcd8e0868345d77a81abea0db8e0aa32a6b55e264fe18b7f577
Gozi
5d002f8a395fcc9a680a9ef4f78a8674cc0757850b02bf12a8ef4df79e2e4bd3
Gozi
5f65108386662cc4780882e06928dd940ea6c75235bf8e4c09079e6e40045326
Gozi
691fdaeb03dfa2b239d82322a3fd47c3b952ae9d47effa0100153fde537dc4e5
Gozi
83d9e62cebb8f222083e6d6670b0ca5e82459c8d7815b0c415c9d1964bd56583
Gozi
9164fdcb36a96b934a66b23da4101dc5a24ccc8807aeb12760132fe4e64c5a9a
Gozi
9be883a15e12a4e3504cb959269855ad8a0cbda99b10b8432fe5e2e0375d5820
Gozi
a2fa5a4d18033e67a7c0477e69acd03a61808c31e24dd9c120106fec161012ef
Gozi
ae1143cc98f29dad7cd956c881606f55b51d8b5789ae670736e6e115519fbccb
Gozi
+ 260 additional samples on MalwareBazaar
Result
Malware family:
gozi_ifsb
Create hunting rule
Score:
  10/10
Tags:
family:gozi_ifsb botnet:8877 banker trojan
Link:
https://tria.ge/reports/210504-2q7vap6cpn/
Behaviour
Suspicious use of WriteProcessMemory
Gozi, Gozi IFSB
Malware Config
C2 Extraction:
outlook.com/login
gmail.com
dorelunonu.us
morelunonu.us
Unpacked files
SH256 hash:
2f2791015c26c87441386052e11bf2a194e22e8c515362bb00dd263430798e07
MD5 hash:
1980e325c73adcc0c2b78c0fd99bb37b
SHA1 hash:
c3dcad02e5bd451159eceb8a226e67f60aa1b4a0
Detections:
win_isfb_auto
Create hunting rule
Link:
https://www.unpac.me/results/f764af43-5c8f-438f-8dd9-e587650ac9e8/
SH256 hash:
bd43f7bc23a76b086a81b8e6fcd4355cac648d3f7d9a941d9aa259def534d5b1
MD5 hash:
18d613d02eaf8d339feebb21f578f329
SHA1 hash:
01ea39853139ccfe82f0bd19f8963d3ccebf8e8a
Link:
https://www.unpac.me/results/f764af43-5c8f-438f-8dd9-e587650ac9e8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bd43f7bc23a76b086a81b8e6fcd4355cac648d3f7d9a941d9aa259def534d5b1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gozi

DLL dll bd43f7bc23a76b086a81b8e6fcd4355cac648d3f7d9a941d9aa259def534d5b1

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1192352/
  
Delivery method
Distributed via web download

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-04 16:19:29 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [C0027.009] Cryptography Micro-objective::RC4::Encrypt Data
1) [C0021.004] Cryptography Micro-objective::RC4 PRGA::Generate Pseudo-random Sequence
2) [C0052] File System Micro-objective::Writes File
3) [C0034.001] Operating System Micro-objective::Set Variable::Environment Variable
4) [C0040] Process Micro-objective::Allocate Thread Local Storage
5) [C0043] Process Micro-objective::Check Mutex
6) [C0041] Process Micro-objective::Set Thread Local Storage Value
7) [C0018] Process Micro-objective::Terminate Process