MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d76182aef0d25dcc9d6ddfffc5578d42ace4a7525ead3e4fa2070c33f142f042. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d76182aef0d25dcc9d6ddfffc5578d42ace4a7525ead3e4fa2070c33f142f042
SHA3-384 hash: 46dafe261ea2066b01218905ce855eac4dfff49e2b092a19b7e8336d2baec7a5a5eb32e0f43d75a0befe9b47006621a9
SHA1 hash: 5e9a07945ceac9dbb3b5c928ca09e9032a15f66b
MD5 hash: 9e2485e830c42702fcb82acf44c027dc
humanhash: cold-mississippi-enemy-nine
File name:avviso_01.xll
Download: download sample
Signature Gozi
Create hunting rule
File size:675'328 bytes
First seen:2022-02-04 07:14:27 UTC
Last seen:2022-02-04 09:10:20 UTC
File type:Excel file xll
MIME type:application/x-dosexec
imphash 0d1c2e8773adbfbc64d57aab36998066 (3 x Smoke Loader, 1 x Formbook, 1 x ArkeiStealer)
ssdeep 12288:3fBUkVbwLSI5/Q8OF8bzbBSreCOi6TyuWD242S6+4Mam:5UrO2X1pJdWeS6ZH
TLSH T15DE47C56BEC66EA2EF7F55B783A0EA3D1156736D03A08ACF760305993911FD2413EA03
Reporter JAMESWT_WT
Tags:32b Gozi isfb Loader pw febbraio=22 Ursnif xll

Intelligence

File Origin
# of uploads :
2
# of downloads :
360
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
avviso.zip
Verdict:
Malicious activity
Analysis date:
2022-02-04 07:13:41 UTC
Tags:
opendir
Link:
https://app.any.run/tasks/bd2352c0-6f7d-4e03-8c2c-01065fb7796d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Variant.Mikey.133702.340.13282.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malicious
File Type:
Office Add-Ins - Suspicious
Link:
https://app.docguard.net/d76182aef0d25dcc9d6ddfffc5578d42ace4a7525ead3e4fa2070c33f142f042/results/dashboard
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm greyware packed
Link:
https://www.filescan.io/uploads/61fce9fd6d25ac9e7904b400/reports/c462adc3-ac31-4291-a93f-ea6a95186216/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
ByteCode-MSIL.Trojan.ExcelAddin
Create hunting rule
Status:
Malicious
First seen:
2022-02-04 07:13:08 UTC
File Type:
PE (Dll)
Extracted files:
2
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=25qyflxq2jo4zhln3774kv4nikwojj2sl2wt4t5ca4gdh4kc6bba._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
persistence suricata
Link:
https://tria.ge/reports/220204-h28wxsfcdp/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Drops file in Windows directory
Loads dropped DLL
Sets service image path in registry
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d76182aef0d25dcc9d6ddfffc5578d42ace4a7525ead3e4fa2070c33f142f042

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments