MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e5420c67e6613cf86f490123904ea3ae05187932f3282b8fa25d94959b0a5bc2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash: e5420c67e6613cf86f490123904ea3ae05187932f3282b8fa25d94959b0a5bc2
SHA3-384 hash: 6af8550ce1aa324a4fe3aef4d440990925bd01452998feb5f16419affd68720407b41454d82c33187a070457da9924d6
SHA1 hash: 935ed57efb266605eb481ab59f9f0adf827379fc
MD5 hash: ec75699dee27efe38cd8608edd5fd876
humanhash: mobile-sweet-cold-winner
File name:e5420c67e6613cf86f490123904ea3ae05187932f3282b8fa25d94959b0a5bc2
Download: download sample
Signature n/a
File size:832'512 bytes
First seen:2020-03-23 18:48:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ee19596f1bff55070232c91c2a4a1352
ssdeep 12288:NqnA+N1tBl0ZH+dhjQcTddW4avSzrTPdwAJwvaSOIx+l0Ub1p5I3AElvfmU:YbuHKGcTddovS/DdvqvaSYljywHU
Threatray 1'678 similar samples on MalwareBazaar
TLSH 3605F1117791C832D2BE20710916D776A6BA7C306F35878BBBA07B3E8E701D19A3535B
Reporter @Marco_Ramilli


File Origin
# of uploads :
# of downloads :
Origin country :
Mail intelligence
No data
Vendor Threat Intelligence

YARA Signatures

MalareBazaar uses YARA rules from several public and non-public repositories, such as Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious proccess dumps they may create. Please note that only results from TLP:WHITE rules are being displayeyd.

Rule name:Ursnif
Author:JPCERT/CC Incident Response Group
Description:detect Ursnif(a.k.a. Dreambot, Gozi, ISFB) in memory
Reference:internal research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe e5420c67e6613cf86f490123904ea3ae05187932f3282b8fa25d94959b0a5bc2

(this sample)

Delivery method
Distributed via web download