MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e33a713b96b45e2b2e0da350c0fdaaf865139607066aadff3b67b0ced82ca8bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e33a713b96b45e2b2e0da350c0fdaaf865139607066aadff3b67b0ced82ca8bc
SHA3-384 hash:	a2cf95bf4bffc7d40205e3bf6353c69274d852fcb8e75b1edafb3c212d33cf43e4531cae505174a759f06b5ebc00b066
SHA1 hash:	a68deea2d4f40bef60c7f605bc2aae9698259e69
MD5 hash:	d0584edcc980ef43e697629ade83c54b
humanhash:	shade-salami-tango-seven
File name:	ini.dll
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	294'400 bytes
First seen:	2023-05-26 11:36:03 UTC
Last seen:	2023-05-26 12:15:22 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	3c3dece0112fc0b5785073312600144a (1 x Gozi)
ssdeep	6144:YwqnlTIaNrhtD+Cqdoazww2X/4TFEX0Ia:5qln1Y2MTGkI
TLSH	T11D544B6E35A41DE8DD77C138C6829A22FA727C442334F6DB17A445A60F33BF16639329
TrID	48.7% (.EXE) Win64 Executable (generic) (10523/12/4) 23.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 9.3% (.EXE) OS/2 Executable (generic) (2029/13) 9.2% (.EXE) Generic Win/DOS Executable (2002/3) 9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter	abuse_ch
Tags:	dll exe Gozi isfb Ursnif

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

325

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

cd8393350f7cfc0762e09ee3b0a98002a1b9abf362caf5f210e717e1d4ebe53a

Verdict:

Malicious activity

Analysis date:

2023-05-26 09:38:43 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/5f0118e4-93d3-4696-be05-83295d63a6a2

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/392044/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan-Banker.Win32.Gozi.ojt.18085.31639.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a custom TCP request

Certego Dragonfly Suspicious

Result

Malware family:

n/a

Score:

  5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/88014/overview

Behaviour

MalwareBazaar

FileScan.IO No Threat

Verdict:

No Threat

Threat level:

  2/10

Confidence:

100%

Tags:

lolbin packed

Link:

https://www.filescan.io/uploads/647099df5a682a6d5f60c55b/reports/dee9b754-5f23-4fa0-9935-dd5e9b567e59/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/e33a713b96b45e2b2e0da350c0fdaaf865139607066aadff3b67b0ced82ca8bc

Intezer Ursnif

Malware family:

Ursnif

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3680ed46-fae0-45ba-a92f-c64592f2165d

Joe Sandbox Ursnif

Result

Threat name:

Ursnif

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1243262

Signature

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Ursnif

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e33a713b96b45e2b2e0da350c0fdaaf865139607066aadff3b67b0ced82ca8bc/

ReversingLabs TitaniumCloud Win64.Trojan.Ursnif

Threat name:

Win64.Trojan.Ursnif

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-05-26 09:38:09 UTC

File Type:

PE+ (Dll)

Extracted files:

1

AV detection:

15 of 37 (40.54%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4m5hco4wwrpcwlqnunimb7nk7bsrhfqhazvk37z3m6ym5wbmvc6a._file

Threatray unknown

Verdict:

unknown

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/230526-nq5m1sff91/

UnpacMe

Unpacked files

SH256 hash:

e33a713b96b45e2b2e0da350c0fdaaf865139607066aadff3b67b0ced82ca8bc

MD5 hash:

d0584edcc980ef43e697629ade83c54b

SHA1 hash:

a68deea2d4f40bef60c7f605bc2aae9698259e69

Link:

https://www.unpac.me/results/aefe8dd9-1988-4dc1-a260-d8628316bc60/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e33a713b96b45e2b2e0da350c0fdaaf865139607066aadff3b67b0ced82ca8bc

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/392044/