MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d54de22fcdc8d2789e8a5da2bb660895d04ac6bfcfbe063d86a6b4087729cf8b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d54de22fcdc8d2789e8a5da2bb660895d04ac6bfcfbe063d86a6b4087729cf8b
SHA3-384 hash: 318f67fe4ff84d3c78da1f5989cac0c0441c52712aa2b847c20e0a48def64b8b0ee96c0eb98a6a9068405fcdd6db2b2c
SHA1 hash: bdd9cc65263eb96924d833e59ebc5788731aeee9
MD5 hash: 9d71a3a50e8dba8b39405a10c4c49a84
humanhash: wyoming-papa-oven-massachusetts
File name:SecuriteInfo.com.Variant.Graftor.770268.10923.27183
Download: download sample
Signature Gozi
Create hunting rule
File size:229'888 bytes
First seen:2020-07-21 03:02:26 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 87fc93cb54b57f245d75a270795c77aa (114 x Gozi, 1 x TrickBot)
ssdeep 3072:U6VYA6I0oElwS9ciW+eM+ppv2LHF3p6+7bUSrtB0J3B1rq46vqDyPIKpPLq/M:UWxXElK+Spv2ZwSlt6JR1YSDuImq/M
Threatray 731 similar samples on MalwareBazaar
TLSH 3D248D0075848039E9BF02364A7ED668467CBD218BA1D9EBB7C84E4F5B390D27B31767
Reporter SecuriteInfoCom
Tags:Gozi

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/29554/
Detection(s):
SecuriteInfo.com.Variant.Graftor.770268.10923.27183.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/392276
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d54de22fcdc8d2789e8a5da2bb660895d04ac6bfcfbe063d86a6b4087729cf8b/
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 03:04:11 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
icedid
Create hunting rule
gozi
Create hunting rule
Similar samples:
00b24762f3358c6e4e91cae4f2832ca8c00b47cccd6af0a886c66c09dbe4e3dc
Gozi
044570e476fbea2418a21ebab87e766afad25ae10192ef104bb0c62bdea7d9be
Gozi
226d634e84b217a6969b20bb31da631ed30e223812f5a5a70dc76fa16febbe32
Gozi
3dc82a244461087be6a1a675c8afbe868fbe6ab8c5d9261f177cd0322b727ac9
Gozi
3e9ca4a503a6f2a8ac751d5a4fdabb4b0095114acf558c301ee6b9642885f719
Gozi
517801ae25fbba7eecba22323f0375712d0ffe00178a12c983cff0cf28365d73
Gozi
6e10cabc36b1df1253421c93421fa79160791ef65781b1fdc84cc118242bb2a4
Gozi
80fbe00737ff292a77c245496c72062d1a843e6caf698ac7deb2f00d31ea11f0
Gozi
86c4a0358f3fd1bf879f3cb043fe032cb24e86fe5f099183a15ab8776e88ee7e
Gozi
a3021760e6cfeb7363429da04452dbea512fb7efb32faceabd8e8dd6121b477f
Gozi
+ 721 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/200721-qjtebfv196/
Behaviour
Suspicious use of WriteProcessMemory
Modifies system certificate store
Suspicious use of WriteProcessMemory
Blacklisted process makes network request
Blacklisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d54de22fcdc8d2789e8a5da2bb660895d04ac6bfcfbe063d86a6b4087729cf8b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/29554/

Comments