MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 df8a5ac88c6a185144000e908d8dac0045d92525a84353c9b94c04aec5550dac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	df8a5ac88c6a185144000e908d8dac0045d92525a84353c9b94c04aec5550dac
SHA3-384 hash:	d48c3d37abaf7aa831f9693ab3371e11aea18475c612e045e7f483b4a4e4ac2ec1a2877782d9d94a4e50a2022aa7dc5f
SHA1 hash:	84fbfba5847474e4fd81e0152a89dbea29cee704
MD5 hash:	f66f610515864244902840bad733a204
humanhash:	item-lamp-victor-jupiter
File name:	verificare.zip
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	486 bytes
First seen:	2023-01-23 09:11:48 UTC
Last seen:	2023-01-23 10:53:12 UTC
File type:	zip
MIME type:	application/zip
ssdeep	12:5j35RmyntInHLS4RsmVDPUrRtmyntR45u9c:935Yat2HLJKmVg2atRW
TLSH	T1D6F0A331ED5F9544F92EC7B4ECC537934E9249CD99724C4B14F7451154012449FBDE0D
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	JAMESWT_WT
Tags:	agenziaentrate Gozi Ursnif zip

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

89

Origin country :

IT

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	verificare.url
File size:	195 bytes
SHA256 hash:	9ce62ce611e015b9317a3c28b0d52b21a5ec7f862585cddec2733cf727f9dc32
MD5 hash:	92a8e2a4fb2c38d8150d3972b2c88120
MIME type:	text/plain
Signature	Gozi

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

TwinWave.EvilShortcut.DottedQuadDancingInHeavenZip.20230105.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilShortcut.DottedQuadDancingInHeaven.20230105.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

80%

Tags:

remote

Link:

https://www.filescan.io/uploads/63ce4f64416d38777a79edbc/reports/4507b695-d581-49c1-ba8e-a9cd0dcfa062/overview

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Link:

https://labs.inquest.net/dfi/sha256/df8a5ac88c6a185144000e908d8dac0045d92525a84353c9b94c04aec5550dac

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/df8a5ac88c6a185144000e908d8dac0045d92525a84353c9b94c04aec5550dac/

ReversingLabs TitaniumCloud Script-JS.Trojan.Ursnif

Threat name:

Script-JS.Trojan.Ursnif

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-01-23 09:12:06 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

3 of 26 (11.54%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=36ffvsemnimfcraab2ii3dnmabc5sjjfvbbvhsnzjqck5rkvbwwa._file

Hatching Triage gozi

Result

Malware family:

gozi

Alert

Create hunting rule

Score:

  10/10

Tags:

family:gozi botnet:7707 banker isfb trojan

Link:

https://tria.ge/reports/230123-lerkxacf97/

Behaviour

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Gozi

Malware Config

C2 Extraction:

checklist.skype.com
62.173.149.10
31.41.44.27
193.0.178.235

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/df8a5ac88c6a185144000e908d8dac0045d92525a84353c9b94c04aec5550dac