🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd8393350f7cfc0762e09ee3b0a98002a1b9abf362caf5f210e717e1d4ebe53a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cd8393350f7cfc0762e09ee3b0a98002a1b9abf362caf5f210e717e1d4ebe53a
SHA3-384 hash: e0b20d32a4542a75ab73767fc969bbb6ccea4cd3437e6655a850da738d582fd67503a19d8218a8e7fa1297d9871b18a7
SHA1 hash: df89381239f8a8ececeb697a6a35a573203bac09
MD5 hash: 82ff84cb9924f0855a894e75b5d3edb2
humanhash: hydrogen-indigo-violet-triple
File name:cd8393350f7cfc0762e09ee3b0a98002a1b9abf362caf5f210e717e1d4ebe53a
Download: download sample
Signature Gozi
Create hunting rule
File size:6'096'508 bytes
First seen:2023-05-26 09:37:54 UTC
Last seen:2023-05-26 12:13:47 UTC
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 98304:ajJzMUpQ/2zKN5DmsQPKEvia5Zld9l4jH43ZnzgB1wLhQNHFRaFUDAQQHk8iQdvk:M5NzKNgsKKE6UZD9l4IZnzgLwLhQNHFd
Threatray 9 similar samples on MalwareBazaar
TLSH T136561222B2C3C532C55D0277E968FE5E0539BE73473101E777E9396E99B48C1A27AB02
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter WhichbufferArda
Tags:Gozi msi

Intelligence

File Origin
# of uploads :
2
# of downloads :
124
Origin country :
DE DE
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/392030/
Detection(s):
SecuriteInfo.com.Trojan-Banker.Win32.Gozi.ojt.5200.8746.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
lolbin msiexec.exe shell32.dll
Link:
https://www.filescan.io/uploads/64707dfbeabc80ed3afa84cd/reports/72c25aac-f494-479f-822c-f7faeeeef129/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/cd8393350f7cfc0762e09ee3b0a98002a1b9abf362caf5f210e717e1d4ebe53a
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1243153
Signature
Drops executables to the windows directory (C:\Windows) and starts them
Snort IDS alert for network traffic
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 876164 Sample: 2UoXCbfNSl.msi Startdate: 26/05/2023 Architecture: WINDOWS Score: 52 41 Snort IDS alert for network traffic 2->41 7 msiexec.exe 84 40 2->7         started        11 cmd.exe 2 2->11         started        13 cmd.exe 2 2->13         started        15 msiexec.exe 2 2->15         started        process3 file4 33 C:\Windows\Installer\MSI2E51.tmp, PE32 7->33 dropped 35 C:\Windows\Installer\MSI2A38.tmp, PE32 7->35 dropped 37 C:\Windows\Installer\MSI28B0.tmp, PE32 7->37 dropped 39 5 other files (none is malicious) 7->39 dropped 43 Drops executables to the windows directory (C:\Windows) and starts them 7->43 17 MSI2E51.tmp 7->17         started        19 msiexec.exe 7->19         started        21 MSI2A38.tmp 7->21         started        23 net.exe 1 11->23         started        25 conhost.exe 11->25         started        27 conhost.exe 13->27         started        29 nltest.exe 1 13->29         started        signatures5 process6 process7 31 net1.exe 1 23->31         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cd8393350f7cfc0762e09ee3b0a98002a1b9abf362caf5f210e717e1d4ebe53a/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zwbzgnippt6aoyxat3r3bkmaakq3tk7tmlfpl4qq44l6dvhl4u5a._file
Verdict:
malicious
Similar samples:
7166dcc58ddaaa984ca15df83285a659443502c608c2290f3b4578b407e87d22
Gozi
77b07db364c5c3c48d3078785b9fe9a6f3e6b7fcb0fa7212b9b8b1ecc0a229b1
Gozi
8a5a24a29f6dd98600724e6e19abf0ee2be65260233fabdcf35a01c61b981f11
Gozi
8fdbc21d9e0686efc0f887d7f92e1396fdfc33bbe6798c8261f2db363477007d
Gozi
ab9bd97e350f7131c358da0db0d78182e4b96790155b646dc773df96e317d5cd
Gozi
ac8ba32c27d3dc8fa0eef48f3d3de5032df74dd476cf0669f92fecd617c4e10d
Gozi
c9b591e9a5ccf5416b94aa3b4fac9bece16fb836d1ae4161dcdae295259e01aa
Gozi
ee6ac02114acd78d80592784156ef0efdf63705c863ae96fcfaef2530d56414d
Gozi
Result
Malware family:
gozi
Create hunting rule
Score:
  10/10
Tags:
family:gozi botnet:1000 banker ldr4 trojan
Link:
https://tria.ge/reports/230526-ll2pfseg92/
Behaviour
Checks SCSI registry key(s)
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Drops file in Program Files directory
Drops file in Windows directory
Enumerates connected drives
Executes dropped EXE
Loads dropped DLL
Blocklisted process makes network request
Gozi
Malware Config
C2 Extraction:
https://sumarno.top
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cd8393350f7cfc0762e09ee3b0a98002a1b9abf362caf5f210e717e1d4ebe53a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_msi_file
Create hunting rule
Author:Johnk3r
Description:Detects common strings, DLL and API in Banker_BR

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/WhichbufferArda/status/1661866708997423106
Cape
Cape
https://www.capesandbox.com/analysis/392030/

Comments