🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c9b591e9a5ccf5416b94aa3b4fac9bece16fb836d1ae4161dcdae295259e01aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c9b591e9a5ccf5416b94aa3b4fac9bece16fb836d1ae4161dcdae295259e01aa
SHA3-384 hash: 960f9558e30cca4d70a531424c2f4d49b851e214cc5f3ab05bb27950eab65add6233bbeab989bddccb5860fabf7c751b
SHA1 hash: 11b7d2d7451c80621f657662eb738966e2026098
MD5 hash: 7fc18c44f481a5941e2d068a2cdebe0e
humanhash: tango-wyoming-hotel-idaho
File name:a.msi
Download: download sample
Signature Gozi
Create hunting rule
File size:1'858'295 bytes
First seen:2023-05-18 14:28:53 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 49152:vpyP2OmJH6g7sJzM+C5JCNS5WPvwaq7m6x:6jJzMUpc
Threatray 22 similar samples on MalwareBazaar
TLSH T1C085AD21B287C132D56D0177E958FE6E1539FE73073041E777E83A6E99B08C1A27AB12
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter proxylife
Tags:Gozi LDR4 msi

Intelligence

File Origin
# of uploads :
1
# of downloads :
141
Origin country :
IE IE
Vendor Threat Intelligence
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
lolbin msiexec.exe shell32.dll
Link:
https://www.filescan.io/uploads/646636306bf3fb67fd457523/reports/5795959f-05f0-4c9a-a08a-38acd2e95d49/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/c9b591e9a5ccf5416b94aa3b4fac9bece16fb836d1ae4161dcdae295259e01aa
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1236023
Signature
Drops executables to the windows directory (C:\Windows) and starts them
Snort IDS alert for network traffic
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 869018 Sample: a.msi Startdate: 18/05/2023 Architecture: WINDOWS Score: 52 41 Snort IDS alert for network traffic 2->41 7 msiexec.exe 84 40 2->7         started        11 cmd.exe 2 2->11         started        13 cmd.exe 2 2->13         started        15 msiexec.exe 2 2->15         started        process3 file4 33 C:\Windows\Installer\MSI973D.tmp, PE32 7->33 dropped 35 C:\Windows\Installer\MSI9353.tmp, PE32 7->35 dropped 37 C:\Windows\Installer\MSI91BB.tmp, PE32 7->37 dropped 39 5 other files (none is malicious) 7->39 dropped 43 Drops executables to the windows directory (C:\Windows) and starts them 7->43 17 MSI973D.tmp 7->17         started        19 msiexec.exe 7->19         started        21 MSI9353.tmp 7->21         started        23 net.exe 1 11->23         started        25 conhost.exe 11->25         started        27 conhost.exe 13->27         started        29 nltest.exe 1 13->29         started        signatures5 process6 process7 31 net1.exe 1 23->31         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c9b591e9a5ccf5416b94aa3b4fac9bece16fb836d1ae4161dcdae295259e01aa/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zg2zd2nfzt2uc24uvi5u7le35tqw7obw2gxecyo43lrjkjm6agva._file
Verdict:
malicious
Similar samples:
172cb1322426beea46f573cb656490a665c664e886ede101715d8a7e984c7915
Gozi
74b57e264dd84cbb7c4e1a7eb8a8dbdb932f01ac34e48e2e6d41ab82f05c682f
Gozi
846a8058cda54207aebb885f99dab0eab57529eb8dd94a3d57bbde2e93c4aad4
Gozi
88de34ad95486071b8796d95150461a8a7968d1eb8817772e892d258f3aa1c91
Gozi
8fdbc21d9e0686efc0f887d7f92e1396fdfc33bbe6798c8261f2db363477007d
Gozi
9361fca92e7267e01b4162ba18727539bea414acbbd21e739fcf1fa98584660d
Gozi
ac6a11ecf700dafee430abe06d62b96a2180f08b1b83b7128e2b9bcab1d67959
Gozi
+ 12 additional samples on MalwareBazaar
Result
Malware family:
gozi
Create hunting rule
Score:
  10/10
Tags:
family:gozi botnet:1000 banker ldr4 trojan
Link:
https://tria.ge/reports/230518-rtj29scd96/
Behaviour
Checks SCSI registry key(s)
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Drops file in Program Files directory
Drops file in Windows directory
Enumerates connected drives
Executes dropped EXE
Loads dropped DLL
Blocklisted process makes network request
Gozi
Malware Config
C2 Extraction:
https://bastarka.top
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c9b591e9a5ccf5416b94aa3b4fac9bece16fb836d1ae4161dcdae295259e01aa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_msi_file
Create hunting rule
Author:Johnk3r
Description:Detects common strings, DLL and API in Banker_BR

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments