MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd10d150eef5383972a6c479e1c85f259874828aa33aae2da36b118b4fcc6961. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cd10d150eef5383972a6c479e1c85f259874828aa33aae2da36b118b4fcc6961
SHA3-384 hash: 8da4b286a114646ce2b81a6de5e4c22f6aab16eebd469f9266d5d6c49b947031223ef81d99ec8892f506f30eaa73e9b3
SHA1 hash: 9e358a226a96239317c245cd1a707849d2f5330f
MD5 hash: 0bcd333f593a357d87e08e0693c2ed45
humanhash: fish-edward-zebra-tango
File name:portfolio.vbs
Download: download sample
Signature Gozi
Create hunting rule
File size:541 bytes
First seen:2023-09-19 06:30:38 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 12:JhK78VhirNu8VH22nKkOoit5RtAKPHxiWttdlTtt+NH8CtuO:JVsZtRnPOo6hAqc6bXm8CtuO
Threatray 664 similar samples on MalwareBazaar
TLSH T16EF0E945E83DCC51854747734FB65A09DFEFC0E512B3CC989710AD5435540918B39376
Reporter JAMESWT_WT
Tags:62-173-145-113 Gozi Ursnif vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
126
Origin country :
IT IT
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/449567/
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
certutil fingerprint greyware packed stealer
Link:
https://www.filescan.io/uploads/6509402732ffdb7a7a0b3876/reports/035a584f-f66e-4940-a145-c148c1cb6431/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/cd10d150eef5383972a6c479e1c85f259874828aa33aae2da36b118b4fcc6961
Result
Verdict:
MALICIOUS
Result
Threat name:
n/a
Detection:
suspicious
Classification:
n/a
Score:
21 / 100
Link:
https://www.joesandbox.com/analysis/1310560
Signature
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cd10d150eef5383972a6c479e1c85f259874828aa33aae2da36b118b4fcc6961/
Threat name:
Script-WScript.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2023-09-19 06:25:45 UTC
File Type:
Text (VBS)
AV detection:
6 of 22 (27.27%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zuincuho6u4ds4vgyr46dsc7ewmhjaukum5k4lndnmiywt6mnfqq._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
0c6ec08f7cf0c7e2284cab850388cb8919331db2209e1a84169c016430638f78
Gozi
1c57d98519e5b1381e69949076bd8eefca421b90a51f15220a1092afbc7631b3
Gozi
326ad767ee63a1d88df314fc691c55cbf3e5b90985d858a649ccede0661f584d
Gozi
4151f81469e5278e9381d10485efbe66e4ca5d8c2f863aa4c3df8e577dc96614
Gozi
573ecacb1ccfd4965e899ed3bb811181bf78b62399e10a5690491eb199e0291c
Gozi
6b82d78ff4d6f55b4b66ed8410897cec1e845d65ba8f9e77f4f0e4ed499a0d1c
Gozi
9a73aac68d8941fa339bf2b9d12c2ddabc734cf94d0070cbd5c8b7e25ee92f29
Gozi
+ 654 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/230919-g92xxafc7t/
Behaviour
Modifies registry class
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Drops startup file
Downloads MZ/PE file
Malware family:
Ursnif
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/cd10d150eef5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cd10d150eef5383972a6c479e1c85f259874828aa33aae2da36b118b4fcc6961

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Certutil_Decode_OR_Download
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Certutil Decode
Reference:Internal Research
Rule name:SUSP_OneNote
Create hunting rule
Author:spatronn
Description:Hard-Detect One

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/449567/

Comments