🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d1ca0d9f10382d484d02e90d4d5d987653de42a8c4eb5544e4368e4f1965803c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d1ca0d9f10382d484d02e90d4d5d987653de42a8c4eb5544e4368e4f1965803c
SHA3-384 hash: 53a19f2101da2d9cc526fd6ed1b871223ab938bba2e3080a89c1f5eacf1ab953aff38a790b9cb9c415d7b49eaeb8ced1
SHA1 hash: 472513fe01ecbc2f51d70d762c1992a4a24c6c15
MD5 hash: 687f33ac9cb2e8b3c1e7659422caf253
humanhash: shade-golf-happy-stairway
File name:61f113091fd0c.dll
Download: download sample
Signature Gozi
Create hunting rule
File size:1'062'256 bytes
First seen:2022-01-26 09:24:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2aebc4455d4d4828b36e9df040988a2b (1 x Gozi)
ssdeep 12288:JZbmvejxoFNjrmkkHZkkkkkEkk2bkkkmkMcpmmkkkknkkkkk0TKxvsXkCk1jX3k+:JZaGeF7
TLSH T1A7354E6FAA055C9DF83322FA282F2A294717F95F901C56CDF1A67E222F525634036F07
Reporter JAMESWT_WT
Tags:dll exe Gozi isfb TNT Ursnif

Intelligence

File Origin
# of uploads :
1
# of downloads :
395
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
61f113091fd0c.dll
Verdict:
Malicious activity
Analysis date:
2022-01-26 09:30:34 UTC
Tags:
trojan gozi ursnif dreambot evasion
Link:
https://app.any.run/tasks/5a441dff-2e50-4e79-9d82-c86650f7c179

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/223112/
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
DNS request
Using the Windows Management Instrumentation requests
Sending an HTTP GET request
Launching a process
Creating a process with a hidden window
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/5162/overview
Behaviour
MalwareBazaar
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/61f1137659d130b02a52c8cd/reports/f84cbe2d-8829-4384-9739-1906b966548c/overview
Malware family:
Ursnif
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/36560eed-2d71-4b1a-8436-4acfcfa71926
Result
Threat name:
Ursnif
Create hunting rule
Detection:
malicious
Classification:
bank.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/927797
Signature
Allocates memory in foreign processes
Changes memory attributes in foreign processes to executable or writable
Creates a thread in another existing process (thread injection)
Disables SPDY (HTTP compression, likely to perform web injects)
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Self deletion via cmd delete
Sigma detected: Accessing WinAPI in PowerShell. Code Injection.
Sigma detected: MSHTA Spawning Windows Shell
Sigma detected: Suspicious Call by Ordinal
Sigma detected: Suspicious Remote Thread Created
Sigma detected: Windows Shell File Write to Suspicious Folder
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Writes or reads registry keys via WMI
Writes registry values via WMI
Writes to foreign memory regions
Yara detected Ursnif
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 560270 Sample: 61f113091fd0c.dll Startdate: 26/01/2022 Architecture: WINDOWS Score: 100 98 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->98 100 Yara detected  Ursnif 2->100 102 Machine Learning detection for sample 2->102 104 6 other signatures 2->104 9 loaddll32.exe 1 2->9         started        12 mshta.exe 19 2->12         started        14 mshta.exe 2->14         started        16 2 other processes 2->16 process3 signatures4 134 Writes to foreign memory regions 9->134 136 Allocates memory in foreign processes 9->136 138 Modifies the context of a thread in another process (thread injection) 9->138 140 3 other signatures 9->140 18 regsvr32.exe 9->18         started        22 control.exe 9->22         started        24 cmd.exe 1 9->24         started        26 rundll32.exe 1 9->26         started        28 powershell.exe 12->28         started        30 powershell.exe 14->30         started        32 powershell.exe 16->32         started        34 powershell.exe 16->34         started        process5 dnsIp6 94 192.168.2.1 unknown unknown 18->94 106 Writes to foreign memory regions 18->106 108 Allocates memory in foreign processes 18->108 110 Modifies the context of a thread in another process (thread injection) 18->110 122 2 other signatures 18->122 36 control.exe 18->36         started        112 Changes memory attributes in foreign processes to executable or writable 22->112 114 Injects code into the Windows Explorer (explorer.exe) 22->114 116 Maps a DLL or memory area into another process 22->116 39 rundll32.exe 24->39         started        118 System process connects to network (likely due to code injection or exploit) 26->118 42 control.exe 26->42         started        120 Creates a thread in another existing process (thread injection) 28->120 49 3 other processes 28->49 44 csc.exe 30->44         started        51 2 other processes 30->51 47 csc.exe 32->47         started        53 2 other processes 32->53 55 3 other processes 34->55 signatures7 process8 dnsIp9 124 Changes memory attributes in foreign processes to executable or writable 36->124 126 Injects code into the Windows Explorer (explorer.exe) 36->126 128 Writes to foreign memory regions 36->128 132 4 other signatures 36->132 57 explorer.exe 36->57 injected 96 194.76.226.200, 49752, 49753, 49754 SERVINGADE Germany 39->96 130 Writes registry values via WMI 39->130 60 control.exe 39->60         started        62 rundll32.exe 42->62         started        78 C:\Users\user\AppData\Local\...\sjfy431f.dll, PE32 44->78 dropped 64 cvtres.exe 44->64         started        80 C:\Users\user\AppData\Local\...\oyq1c2cj.dll, PE32 47->80 dropped 66 cvtres.exe 47->66         started        82 C:\Users\user\AppData\Local\...\ugg3o5nf.dll, PE32 49->82 dropped 84 C:\Users\user\AppData\Local\...\pqvogmwc.dll, PE32 49->84 dropped 74 2 other processes 49->74 86 C:\Users\user\AppData\Local\...\0hsihch1.dll, PE32 51->86 dropped 68 cvtres.exe 51->68         started        88 C:\Users\user\AppData\Local\...\oeprcmty.dll, PE32 53->88 dropped 70 cvtres.exe 53->70         started        90 C:\Users\user\AppData\Local\...\tpt0a0ul.dll, PE32 55->90 dropped 92 C:\Users\user\AppData\Local\...\pwlcj2cu.dll, PE32 55->92 dropped 72 cvtres.exe 55->72         started        file10 signatures11 process12 signatures13 142 Changes memory attributes in foreign processes to executable or writable 57->142 144 Self deletion via cmd delete 57->144 146 Disables SPDY (HTTP compression, likely to perform web injects) 57->146 148 Creates a thread in another existing process (thread injection) 57->148 76 rundll32.exe 60->76         started        process14
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d1ca0d9f10382d484d02e90d4d5d987653de42a8c4eb5544e4368e4f1965803c/
Threat name:
Win32.Trojan.Ursnif
Create hunting rule
Status:
Malicious
First seen:
2022-01-26 09:25:13 UTC
File Type:
PE (Dll)
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Result
Malware family:
gozi_ifsb
Create hunting rule
Score:
  10/10
Tags:
family:gozi_ifsb botnet:3000 banker trojan
Link:
https://tria.ge/reports/220126-ldmkkabff4/
Behaviour
Discovers systems in the same network
Enumerates processes with tasklist
Gathers system information
Modifies Internet Explorer settings
Runs net.exe
Runs ping.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in System32 directory
Suspicious use of SetThreadContext
Deletes itself
Gozi, Gozi IFSB
Malware Config
C2 Extraction:
config.edge.skype.com
194.76.226.200
giporedtrip.at
habpfans.at
31.214.157.187
Unpacked files
SH256 hash:
d1ae97952f117454d6633e981ff1635836945bdd303bee32e56d2a738c0a3a85
MD5 hash:
778fad69597a6089f8dd6d7fc56f905c
SHA1 hash:
a62608da301986a6b691525ab880c97c16079928
Detections:
win_isfb_auto
Create hunting rule
Link:
https://www.unpac.me/results/2df14a1d-e144-4d62-b3f4-d5e9f2d8243b/
Parent samples :
d1ca0d9f10382d484d02e90d4d5d987653de42a8c4eb5544e4368e4f1965803c
57f997217db22a4d97700768189d44034303e3b15dc08fa48ed6b91bd7051c05
SH256 hash:
905ff2ec470dcdde568c39cdd60f08889f33834a6469b272830cad7170e13920
MD5 hash:
802f9dc632ffba519d90eabe4b5bd7d8
SHA1 hash:
787141be2ceba97a305076fa1fa015c75ccaa41a
Detections:
win_isfb_auto
Create hunting rule
Link:
https://www.unpac.me/results/2df14a1d-e144-4d62-b3f4-d5e9f2d8243b/
Parent samples :
d1ca0d9f10382d484d02e90d4d5d987653de42a8c4eb5544e4368e4f1965803c
57f997217db22a4d97700768189d44034303e3b15dc08fa48ed6b91bd7051c05
SH256 hash:
d1ca0d9f10382d484d02e90d4d5d987653de42a8c4eb5544e4368e4f1965803c
MD5 hash:
687f33ac9cb2e8b3c1e7659422caf253
SHA1 hash:
472513fe01ecbc2f51d70d762c1992a4a24c6c15
Link:
https://www.unpac.me/results/2df14a1d-e144-4d62-b3f4-d5e9f2d8243b/
Malware family:
Ursnif.Dreambot.D
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/d1ca0d9f1038/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d1ca0d9f10382d484d02e90d4d5d987653de42a8c4eb5544e4368e4f1965803c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gozi

Executable exe d1ca0d9f10382d484d02e90d4d5d987653de42a8c4eb5544e4368e4f1965803c

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/223112/
  
URLhaus
https://urlhaus.abuse.ch/url/2007198/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2007200/
  
URLhaus
https://urlhaus.abuse.ch/url/2007199/

Comments