MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e233642b9cb70dfe4e1fef85988b937e7461dbd41eafbd59694f65e5ddef28f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gozi

Vendor detections: 11

Intelligence 11 IOCs YARA 7 File information Comments

SHA256 hash:	e233642b9cb70dfe4e1fef85988b937e7461dbd41eafbd59694f65e5ddef28f4
SHA3-384 hash:	75d108970f88d6946e851444357dae6170e107f23b056ce7b3a644f5e100172a1d867e0ff9d3944fa62d9b89a55823b8
SHA1 hash:	07658014aefe68ef5f1bc9c19552b371d7aabd70
MD5 hash:	d883ae7403f3adee8c0831c3aac4c208
humanhash:	fish-sierra-freddie-fix
File name:	LisectAVT_2403002C_65.exe
Download:	download sample
Signature	Gozi Create hunting rule
File size:	270'854 bytes
First seen:	2024-07-25 01:49:38 UTC
Last seen:	2024-07-25 02:23:07 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	7c239b12229195f29dde016e51036cf2 (1 x Gozi)
ssdeep	6144:PNdMYdCojCslz3q43XjsEV+FAmpRYtxslEXcMiECHlkTE:VdpdCeqsj90ppy0qXrZgaE
TLSH	T19C4412B3B48C0475EBC207B1A5F8BE21A772678D97027F9243209D4F0D9456A933E79A
TrID	48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.4% (.EXE) Win64 Executable (generic) (10523/12/4) 10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.0% (.EXE) Win32 Executable (generic) (4504/4/1)
Reporter	Anonymous
Tags:	exe Gozi

Anonymous

this malware sample is very nasty!

Intelligence

File Origin

# of uploads :

# of downloads :

394

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Trojan.KillProc.34670.23105.6912.UNOFFICIAL

Gathering data

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

lolbin makecab microsoft_visual_cc overlay packed reg rundll32 shell32 ursnif

Link:

https://www.filescan.io/uploads/66a1af579149fd55f99034fe/reports/b46f0715-a8d8-42ea-adc5-af1a28847a93/overview

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1481304

Behaviour

Behavior Graph:

n/a

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/e233642b9cb70dfe4e1fef85988b937e7461dbd41eafbd59694f65e5ddef28f4

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e233642b9cb70dfe4e1fef85988b937e7461dbd41eafbd59694f65e5ddef28f4/

Threat name:

Win32.Trojan.Ursnif

Status:

Malicious

First seen:

2024-07-25 01:50:12 UTC

File Type:

PE (Exe)

AV detection:

20 of 24 (83.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4izwik44w4g74tq756czrc4tpz2gdw6ud2x32wljj5s6lxppfd2a._file

Verdict:

malicious

Result

Malware family:

gozi

Score:

10/10

Tags:

family:gozi botnet:4099 discovery isfb

Link:

https://tria.ge/reports/240725-b9evgsthmf/

Behaviour

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/dd1739ad-074c-4efc-9fc8-484e5c651771

Unpacked files

SH256 hash:

bc42ff58b15ccf03e88ffc7bc5bd9da1a554e6c3f3c3affb6a3a5fce217dd814

MD5 hash:

23a0647fdebbc168d420ad7680b8223c

SHA1 hash:

78ac6c30afb0e5e93802459515d11a6ea5b54c91

Detections:

ISFB_Main

Link:

https://www.unpac.me/results/f3c1ed9a-c870-4812-81fa-69ea7e4dd560/

SH256 hash:

e4c4b9965dc084b4ee6d577d7fca6c3a9c7460b2dd484c64147a7f303e8e70ea

MD5 hash:

8c61fbaefb7f7f254aa7b9920adb27df

SHA1 hash:

c829137ee3cb93e67f07ac75a9d66d2febeeacdd

Detections:

ISFB_Main

win_isfb_a5

Link:

https://www.unpac.me/results/f3c1ed9a-c870-4812-81fa-69ea7e4dd560/

SH256 hash:

e233642b9cb70dfe4e1fef85988b937e7461dbd41eafbd59694f65e5ddef28f4

MD5 hash:

d883ae7403f3adee8c0831c3aac4c208

SHA1 hash:

07658014aefe68ef5f1bc9c19552b371d7aabd70

Detections:

ISFB_Main

win_isfb_a5

Ursnif

Link:

https://www.unpac.me/results/f3c1ed9a-c870-4812-81fa-69ea7e4dd560/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	malware_Ursnif_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Ursnif(a.k.a. Dreambot, Gozi, ISFB) in memory
Reference:	internal research

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	Ursnif Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Ursnif(a.k.a. Dreambot, Gozi, ISFB) in memory
Reference:	internal research

Rule name:	Ursnif3 Create hunting rule
Author:	kevoreilly
Description:	Ursnif Payload

Rule name:	Windows_Trojan_Gozi_261f5ac5 Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Gozi

exe e233642b9cb70dfe4e1fef85988b937e7461dbd41eafbd59694f65e5ddef28f4

(this sample)

Link

https://bbs.kafan.cn/forum-31-1.html

Delivery method

Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
AUTH_API	Manipulates User Authorization	ADVAPI32.dll::ConvertStringSecurityDescriptorToSecurityDescriptorA
KERNEL_API	Manipulates Windows Kernel & Drivers	ntdll.dll::RtlInitUnicodeString ntdll.dll::ZwClose
SECURITY_BASE_API	Uses Security Base API	ADVAPI32.dll::GetTokenInformation
SHELL_API	Manipulates System Shell	SHELL32.dll::ShellExecuteExA SHELL32.dll::ShellExecuteA
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CreateProcessA ntdll.dll::ZwOpenProcessToken ntdll.dll::ZwOpenProcess KERNEL32.dll::OpenProcess ADVAPI32.dll::OpenProcessToken KERNEL32.dll::VirtualAllocEx
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::GetVolumeInformationA KERNEL32.dll::GetCommandLineA
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CopyFileA ntdll.dll::ZwCreateFile KERNEL32.dll::CreateFileA KERNEL32.dll::DeleteFileA KERNEL32.dll::MoveFileExA KERNEL32.dll::GetWindowsDirectoryA
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegCreateKeyA ADVAPI32.dll::RegOpenKeyExA ADVAPI32.dll::RegOpenKeyA ADVAPI32.dll::RegQueryValueExA ADVAPI32.dll::RegSetValueExA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample