MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e40aebcbc975e71e77cd85240d93690a81c876d7045bd9c2284da9dc9ef0efe1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e40aebcbc975e71e77cd85240d93690a81c876d7045bd9c2284da9dc9ef0efe1
SHA3-384 hash: f633e2ccb7665cb86803d97b42344d4fec9ddedc6d188e74a60296d1d5afb55f059a47eae0f27e8b622623382976d4c2
SHA1 hash: 17e886c6f65a35225656f2958d7d48e1dc44967c
MD5 hash: e69c543b35c3291a56ef7ec8de515997
humanhash: minnesota-undress-paris-kentucky
File name:7260000.dll
Download: download sample
Signature Gozi
Create hunting rule
File size:236'544 bytes
First seen:2022-03-01 14:06:50 UTC
Last seen:2022-03-07 14:38:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 6144:RyihnaKbEFhck6xW3SJ5gtS3z9pjFAl2kO4a8pf:Ryih1EF2k6S/SD9pyl2j8pf
Threatray 18 similar samples on MalwareBazaar
TLSH T1AB345D6AA2E50A96FD7BD6B9CD53C217D7F338451A64C31F13B0CA9A5F47321B218342
Reporter 0x746f6d6669
Tags:exe Gozi

Intelligence

File Origin
# of uploads :
2
# of downloads :
225
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/245820/
Detection(s):
Win.Malware.Ursnif-9884005-0
Create hunting rule

Win.Malware.Ursnif-9886559-0
Create hunting rule

Win.Malware.Ursnif-9892796-0
Create hunting rule

Win.Malware.Ursnif-9896448-0
Create hunting rule

Win.Malware.Ursnif-9917123-0
Create hunting rule

Win.Malware.Ursnif-9937854-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed setupapi.dll shell32.dll
Link:
https://www.filescan.io/uploads/621e28900cd58dbd925b3ebd/reports/343ed8c1-d9ae-42f3-bf90-81e20499b6f7/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Ursnif
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/501a37c1-210d-4524-a764-b638d0386704
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/948234
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Call by Ordinal
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 580711 Sample: 7260000.dll Startdate: 01/03/2022 Architecture: WINDOWS Score: 60 16 store-images.s-microsoft.com 2->16 18 Antivirus / Scanner detection for submitted sample 2->18 20 Multi AV Scanner detection for submitted file 2->20 22 Sigma detected: Suspicious Call by Ordinal 2->22 8 loaddll64.exe 1 2->8         started        signatures3 process4 process5 10 cmd.exe 1 8->10         started        12 rundll32.exe 8->12         started        process6 14 rundll32.exe 10->14         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e40aebcbc975e71e77cd85240d93690a81c876d7045bd9c2284da9dc9ef0efe1/
Threat name:
Win64.Trojan.Ursnif
Create hunting rule
Status:
Malicious
First seen:
2022-02-16 17:13:59 UTC
File Type:
PE+ (Dll)
AV detection:
24 of 43 (55.81%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
2f5ecd0d89ed3bf3c52cfa856f1dd4f68fed09b0cc3b827e43fd8e2fbcf0bfc0
Gozi
4080ff8f402587476926487e628103c97d0519f65f4d3222b152507e60816059
Gozi
71b928fd0b29e21bbfa4755b5347f4dc40653a82ec7ecf4947e325dbec23abaa
Gozi
86b670d81a26ea394f7c0edebdc93e8f9bd6ce6e0a8d650e32a0fe36c93f0dee
Gozi
92382e0ee6dc1abe0665e6703c26dd98aa8f334a2b0c7b25127948b82188e40b
Gozi
93d5291a8c81a426309d688c3b44552824b3dcf4239948154877e895b22de285
Gozi
b8402a77572821ec8207a9ee56b0f0a143b1d156c3b6c4e0ae8449e11d2bc076
Gozi
cde070a46442e1a06c722393a335e8c104904a0581d890bf25a13f9c0db39473
Gozi
f87ed79fbb1a2228c97fb59127eade39c4f8218fa28ddd76b50da177d81438e3
Gozi
fc456d0ac2cfee099478997953f2c7d4e07b47fe32bb109b1a9e40fa6aceb93d
Gozi
+ 8 additional samples on MalwareBazaar
Result
Malware family:
gozi_ifsb
Create hunting rule
Score:
  10/10
Tags:
family:gozi_ifsb botnet:3000
Link:
https://tria.ge/reports/220301-rezjeaacf9/
Malware Config
C2 Extraction:
46.21.153.215
46.21.153.220
46.21.153.233
193.27.14.211
Unpacked files
SH256 hash:
e40aebcbc975e71e77cd85240d93690a81c876d7045bd9c2284da9dc9ef0efe1
MD5 hash:
e69c543b35c3291a56ef7ec8de515997
SHA1 hash:
17e886c6f65a35225656f2958d7d48e1dc44967c
Link:
https://www.unpac.me/results/51ed422b-c2e3-442e-919e-56f769efff6e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/e40aebcbc975e71e77cd85240d93690a81c876d7045bd9c2284da9dc9ef0efe1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/245820/

Comments