MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 da620c65032d49a148b428dab566fed2a1a9af6fb0f53ffc4ea75ae54a2cd6a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gozi

Vendor detections: 12

Intelligence 12 IOCs YARA 1 File information Comments

SHA256 hash:	da620c65032d49a148b428dab566fed2a1a9af6fb0f53ffc4ea75ae54a2cd6a9
SHA3-384 hash:	fadbf55a8d11539419e3db4000738b5a875acc74f5f2fee769709847dfbb62974fccda1c4f0cac45724429e5122d0c73
SHA1 hash:	0786500cc156aa9e1a24ef98fef3f132971c80a2
MD5 hash:	b2f1f09f2c6b55e0d73fc1727b5d11c2
humanhash:	blossom-washington-foxtrot-freddie
File name:	notepad
Download:	download sample
Signature	Gozi Create hunting rule
File size:	281'600 bytes
First seen:	2022-03-08 10:04:05 UTC
Last seen:	2022-03-08 12:16:49 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	30b61c273b1d343ed1b1e7a06292b7df (5 x Gozi, 1 x RaccoonStealer, 1 x Loki)
ssdeep	3072:z2bMG3k5fjLPsxJ51I4Xg5U7QlT50iVggjcGkNIVqIJXsDqql2q:Yv3kBjLPsxlpg5WP67ITsq2sDFl
Threatray	462 similar samples on MalwareBazaar
TLSH	T14F54AEC276B0C432C092313599A1CBA1DA3EB831F6B0C9477B781B6E6E31FD19A75746
File icon (PE):
dhash icon	367e7c7d727e6e72 (2 x Gozi, 1 x RedLineStealer, 1 x RaccoonStealer)
Reporter	JAMESWT_WT
Tags:	exe Gozi isfb ITA mise Ursnif

Intelligence

File Origin

# of uploads :

# of downloads :

358

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/248153/

Detection(s):

SecuriteInfo.com.Trojan.Gozi.852.29826.10581.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/8548/overview

Behaviour

MeasuringTime

SystemUptime

EvasionQueryPerformanceCounter

EvasionGetTickCount

CheckCmdLine

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Ursnif

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/4c402cea-30ff-408f-ad68-e1138967614e

Result

Threat name:

Ursnif

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/952409

Signature

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found API chain indicative of debugger detection

Found evasive API chain (may stop execution after checking system information)

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Writes or reads registry keys via WMI

Writes registry values via WMI

Yara detected Ursnif

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/da620c65032d49a148b428dab566fed2a1a9af6fb0f53ffc4ea75ae54a2cd6a9/

Threat name:

Win32.Trojan.Ursnif

Status:

Malicious

First seen:

2022-03-08 10:03:06 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

22 of 27 (81.48%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3jrayzidfve2csfufdnlkzx62kq2tl3pwd2t77cou5noksrm22uq._file

Verdict:

malicious

Label(s):

gozi

Gozi

2026ea16eefee29eb4703c64d0db2c756b5684258bb7ed507c275549a1049250

Gozi

576ddf77b8b7a0685f8619125f16bbaebd35b38caf08c5ef6ea19be5a080125b

Gozi

69f4f29d3eb2f05d7b7f4f736375765b7ed97d0948460adb95ad134b1f54a880

Gozi

9eb0bdb45d505a24290b3fe9adb1ac5c856238e91358fcf7e6af73d9a1b9c244

Gozi

bce53e9e5af3e93c647956fd2fe0662e507513c7a3abee2fbc3bcb2f85432406

Gozi

efd04e8f37b1a511e4c723356220d4c07a27a8e8b5a370ea7a7a6b8a5d98ea6b

Gozi

fd42d2aa3df0c3875a00618c4c9e74db288dbe66631875b8582971e63ba6684a

Gozi

+ 452 additional samples on MalwareBazaar

Result

Malware family:

gozi_ifsb

Score:

10/10

Tags:

family:gozi_ifsb botnet:7622 banker trojan

Link:

https://tria.ge/reports/220308-l3z7ysdda9/

Behaviour

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Gozi, Gozi IFSB

Malware Config

C2 Extraction:

botanlink.top
linkspremium.ru
premiumlists.ru

Unpacked files

SH256 hash:

3741ce477a577747dcd6da7a71ae3b5bbe48019b18fb84d2d1aeee0002d9d2d1

MD5 hash:

657b770929aecf3218bb2b9cc801b666

SHA1 hash:

d16f8f83e71a93a061ae4ff3b5e5158959483c60

Detections:

win_isfb_auto

Link:

https://www.unpac.me/results/18acd655-1a6c-4d3d-a276-c32f0b845269/

Parent samples :

efd04e8f37b1a511e4c723356220d4c07a27a8e8b5a370ea7a7a6b8a5d98ea6b
9eb0bdb45d505a24290b3fe9adb1ac5c856238e91358fcf7e6af73d9a1b9c244
da620c65032d49a148b428dab566fed2a1a9af6fb0f53ffc4ea75ae54a2cd6a9
1c6632f98426b86189fde78f0f529fe42eeb2653412b0003090ae6a42c91d268
4bd004047533752383486ead4f6ce67459d38f816d63d110744f0df009b2d022
57d9f65f62b63e02b194c97d66d478f70a75df94abc134d45e02539cbb33d961
14e041ad11be886018e643ed1cff9abe512e787bec794ab585e75f91e2da119e
02f23031b04660ce5d0a3dbd6862640895e37c649963c02d0b367a17d8422ffe
bc2bd3c448b2348629da59a454f409ad5b60f2eb21f175e7e49dd04b2703c0ea
f1d890163f681d1c94337e6459b9c233180ebe755e94095315f7acf0171e1eea
eda3487d5cce3777e504ae88f362c2352de1642fa86200e005ba5a7a3bfbdec0
50ed0329ffb7ae83f7a8042ef7f6bd5af5f308e52f479965358cfe4d646b1847

SH256 hash:

cba3ec7d0bc169ca0ce4a53d8d2ee753354991867fc0264a93639300e4f6f333

MD5 hash:

e7f49957d916e15bf8449f566e9eda8c

SHA1 hash:

391c87ab0dbcc802a8f8d727380caa4c8e9bc781

Detections:

win_isfb_auto

Link:

https://www.unpac.me/results/18acd655-1a6c-4d3d-a276-c32f0b845269/

Parent samples :

SH256 hash:

da620c65032d49a148b428dab566fed2a1a9af6fb0f53ffc4ea75ae54a2cd6a9

MD5 hash:

b2f1f09f2c6b55e0d73fc1727b5d11c2

SHA1 hash:

0786500cc156aa9e1a24ef98fef3f132971c80a2

Link:

https://www.unpac.me/results/18acd655-1a6c-4d3d-a276-c32f0b845269/

Malware family:

Ursnif.Dreambot.D

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/da620c65032d/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/da620c65032d49a148b428dab566fed2a1a9af6fb0f53ffc4ea75ae54a2cd6a9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.