MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cec19d81223baaee1c6c73d5760940bd0ab79d55adb043b63cfa37d08b96f8cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	cec19d81223baaee1c6c73d5760940bd0ab79d55adb043b63cfa37d08b96f8cc
SHA3-384 hash:	8fee2e22b7446fb2b96d63322a41a4025ee00ee14266581f07c070c837f2645d6648ffd57f42508e2467c9f9b953435c
SHA1 hash:	de9d1cbcdf826876553103028a00beb0f3362a07
MD5 hash:	101c6f454993a892b238a6fcdbc81f63
humanhash:	foxtrot-glucose-nitrogen-arizona
File name:	Invoice_09142023_5743322235.zip
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	447'716 bytes
First seen:	2023-09-15 04:56:35 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	6144:/AkX2gX/j9CVXN6zocE8gFWPmyjlE6rvwncY/j8U0i8UZnJX+S0SiFey:/AsiMFiWPJkX/jAibZJX+YQey
TLSH	T12794231662F717F387ADEA6CA44BE6A61E3467F14F304821D3F4CF806B5D299031A4B6
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	JAMESWT_WT
Tags:	goamiev-com Gozi intuit zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

125

Origin country :

IT

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Inv_09142023_129272_307806.js
File size:	1'300'550 bytes
SHA256 hash:	f3489b0781a345b583a77439f980f65df1194f7effed341dcb9cd7e0a6ef3605
MD5 hash:	f04c2cdca76878b53ee26592ad96db68
MIME type:	text/plain
Signature	Gozi

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Zip_1.UNOFFICIAL

Alert

Create hunting rule

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

JS File - Malicious

Link:

https://app.docguard.net/cec19d81223baaee1c6c73d5760940bd0ab79d55adb043b63cfa37d08b96f8cc/results/dashboard

Payload URLs

URL

File name

http://kb.mozillazine.org/Clipboard.autocopy

JS File

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6503e41e9bae8a378558184d/reports/77070508-56e7-4a9d-9427-9b8270da8abe/overview

Hybrid Analysis Mal/DrodZp

Verdict:

Suspicious

Labled as:

Mal/DrodZp

Link:

https://www.hybrid-analysis.com/sample/cec19d81223baaee1c6c73d5760940bd0ab79d55adb043b63cfa37d08b96f8cc

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cec19d81223baaee1c6c73d5760940bd0ab79d55adb043b63cfa37d08b96f8cc/

ReversingLabs TitaniumCloud Script-JS.Downloader.Heuristic

Threat name:

Script-JS.Downloader.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-09-15 04:54:59 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

4 of 37 (10.81%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=z3az3ajchovo4hdmopkxmckaxuflphkvvwyehnr47i35bc4w7dga._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/230915-gkp7tahb6t/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Script User-Agent

Uses Task Scheduler COM API

Drops file in System32 directory

Blocklisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.68

Link:

https://yomi.yoroi.company/submissions/cec19d81223baaee1c6c73d5760940bd0ab79d55adb043b63cfa37d08b96f8cc