MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cff7986462a1035c053de4021e2a59ff8de076b7843137354f871084eaa60f9e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cff7986462a1035c053de4021e2a59ff8de076b7843137354f871084eaa60f9e
SHA3-384 hash: ebc9e15825fd4c6c841ad45bf679019eb7c34da08b5869083ff4b792dd4c0e097b8c0b942ea20644aec5686fdb95cd88
SHA1 hash: f17819ad029c143246924bc7c73b3f97f8ad152c
MD5 hash: 0aebb0625adfbcd1e2a3dc45509bc386
humanhash: hamper-four-bulldog-maine
File name:SecuriteInfo.com.Variant.Ulise.98004.17104.6212
Download: download sample
Signature Gozi
Create hunting rule
File size:1'756'672 bytes
First seen:2020-03-20 11:35:01 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ccd0cc704d272ceff397db5d70443ebf (5 x Gozi)
ssdeep 49152:i3SCMsz/gRCYveFADNrky0JNkTjcXvyJylU/+gHCFVqIbFak8IuEliyq8:izMBRZvYcrky8NkTjcXvyJnWTXqIEk8/
Threatray 252 similar samples on MalwareBazaar
TLSH C3859E393A91D07BD2733634494EE3F9E6BEAD304E74830766911F3D3A315824A2966F
Reporter SecuriteInfoCom
Tags:Gozi

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Ulise.98004.17104.6212.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-03-21 03:52:58 UTC
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z73zqzdcuebvybj54qbb4ksz76g6a5vxqqytonkpq4iij2vgb6pa._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
22a8827e130acc160f37cb5f78da95221287b06b4e593efdfd0dd03283945e02
Gozi
3f254c62ad02f051ac2112f3aa92cb537f95d7de0d3c80ba5c42dc3a8a79090e
Gozi
5bd66c88148005029d20c92e1d793f8d41f47a273a9334f9a85ec31148d0b040
Gozi
9a72f971944fcb7a143017bc5c6c2db913bbb59f923110198ebd5a78809ea5fc
Gozi
a6e6d01862c62f53c73f50d34e5209d51100244389a6fbc0f5863d59154582af
Gozi
aa0b542cfde007f858cd18f0b3a104ccaa6c401c26e908829aed144e13471f20
Gozi
c7a24df45e43686f1331c01a5c77ca492924482e29099e778fdee153e88d8363
Gozi
d92b637296f8fa8031ee7a36ac842225bce725f241963bb8afb737b2b3e4fa42
Gozi
eb55844a34109790b370caba8afbcafb1fd52d0575b7c031cf21a0ff74f7bbc1
Gozi
ef0d6ddb130fee72d17b1c077b332c474205897f806b16d2dd130768429b9add
Gozi
+ 242 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cff7986462a1035c053de4021e2a59ff8de076b7843137354f871084eaa60f9e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ursnif
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Ursnif(a.k.a. Dreambot, Gozi, ISFB) in memory
Reference:internal research
Rule name:win_dreambot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
ole32.dll::CreateStreamOnHGlobal
GDI_PLUS_APIInterfaces with Graphicsgdiplus.dll::GdiplusStartup
gdiplus.dll::GdiplusShutdown
gdiplus.dll::GdipDeleteGraphics
gdiplus.dll::GdipAlloc
gdiplus.dll::GdipCreateFromHDC
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteW
SHELL32.dll::SHGetFileInfoW
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetVolumeInformationW
KERNEL32.dll::GetSystemInfo
KERNEL32.dll::GetStartupInfoW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateFileW
SHLWAPI.dll::PathRemoveFileSpecW
KERNEL32.dll::GetWindowsDirectoryW
KERNEL32.dll::GetSystemDirectoryW
KERNEL32.dll::GetFileAttributesW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuW
USER32.dll::CreateMenu
ole32.dll::OleCreateMenuDescriptor
USER32.dll::EmptyClipboard
USER32.dll::OpenClipboard
USER32.dll::PeekMessageW

Comments