MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 e3fb27a6761d3a9403ff5b3ddbc86e5231664980149c8fd85bcfb319cc1ebb8c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Gozi
Vendor detections: 16
| SHA256 hash: | e3fb27a6761d3a9403ff5b3ddbc86e5231664980149c8fd85bcfb319cc1ebb8c |
|---|---|
| SHA3-384 hash: | f5928bc8f608c9a5e0a5bd246cdfa80caba378d381a9c9c4fe2dd69b7c962b19dfaa21390a92029c062ac11063d1087a |
| SHA1 hash: | 8e5f8b5043e92d425a3731cb2c12bec880279974 |
| MD5 hash: | ce956c480e303a9f77422054365f8e37 |
| humanhash: | helium-quebec-failed-tennessee |
| File name: | e3fb27a6761d3a9403ff5b3ddbc86e5231664980149c8fd85bcfb319cc1ebb8c |
| Download: | download sample |
| Signature | Gozi |
| File size: | 563'200 bytes |
| First seen: | 2022-04-12 10:31:46 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 3743526d94457fb013584724635b7f97 (3 x Gozi) |
| ssdeep | 12288:Jt1GYxq+AVzmKoXmysHMZmaOeVIKjoiUBZ8TOXXGN93Wa:JtQkQmKoXmysHMZDVIDWUa |
| Threatray | 381 similar samples on MalwareBazaar |
| TLSH | T105C45C00B692E03DE8B731F94FAE912DA51DBED0172050C753C51BFA9B366E07E3166A |
| Reporter |  JAMESWT_WT |
| Tags: | exe Gozi isfb Ursnif |
Intelligence
File Origin
# of uploads :
1
# of downloads :
956
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
ursnif
ID:
1
File name:
e3fb27a6761d3a9403ff5b3ddbc86e5231664980149c8fd85bcfb319cc1ebb8c
Verdict:
Malicious activity
Analysis date:
2022-04-13 05:06:20 UTC
Tags:
trojan gozi ursnif dreambot
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Ursnif3
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Using the Windows Management Instrumentation requests
Launching a process
Searching for synchronization primitives
Сreating synchronization primitives
Creating a window
DNS request
Sending an HTTP GET request
Searching for the window
Result
Malware family:
n/a
Score:
10/10
Tags:
n/a
Behaviour
MalwareBazaar
MeasuringTime
CheckNumberOfProcessor
SystemUptime
CPUID_Instruction
EvasionQueryPerformanceCounter
CheckCmdLine
EvasionGetTickCount
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
control.exe greyware greyware icedid keylogger shell32.dll
Malware family:
Ursnif
Verdict:
Malicious
Result
Threat name:
Ursnif
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Writes or reads registry keys via WMI
Writes registry values via WMI
Yara detected Ursnif
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Ursnif
Status:
Malicious
First seen:
2019-10-11 17:26:00 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
29 of 42 (69.05%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
gozi
Similar samples:
+ 371 additional samples on MalwareBazaar
Result
Malware family:
gozi_ifsb
Score:
10/10
Tags:
family:gozi_ifsb botnet:3477 banker trojan
Behaviour
Gozi, Gozi IFSB
Malware Config
C2 Extraction:
google.com
gmail.com
tfernzq.com
c66845582aniyah.club
dcz35percy.top
gmail.com
tfernzq.com
c66845582aniyah.club
dcz35percy.top
Unpacked files
SH256 hash:
e3fb27a6761d3a9403ff5b3ddbc86e5231664980149c8fd85bcfb319cc1ebb8c
MD5 hash:
ce956c480e303a9f77422054365f8e37
SHA1 hash:
8e5f8b5043e92d425a3731cb2c12bec880279974
Malware family:
Ursnif
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.