MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e5dc940537146c1c56b8a8f91234484c83223943c13d2fbf354f0cfdec13c258. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e5dc940537146c1c56b8a8f91234484c83223943c13d2fbf354f0cfdec13c258
SHA3-384 hash: 5a53612ef32fda42271f307c2f15b5bfb550669b56d6df5abb378746b8bc5c11557d0f4bee87897d30e68deadd37c415
SHA1 hash: c471724d86fd269a19932280361ca52e1e294f19
MD5 hash: eed4174c8a96dd7b611d9f109c71e20f
humanhash: xray-nitrogen-quiet-video
File name:eed4174c8a96dd7b611d9f109c71e20f.dll
Download: download sample
Signature Gozi
Create hunting rule
File size:365'400 bytes
First seen:2021-01-12 17:07:23 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 9f377d945db467e35cbad38db9412261 (2 x ZLoader, 2 x Gozi)
ssdeep 3072:Y/citbV4XnbWnfPAQXKSaJtoE7fWtzS3gI6nZVzwqUlre:IHtbyinfPAQ6SaJtoOoxzwqWre
Threatray 89 similar samples on MalwareBazaar
TLSH 50745F459A08B13EDABCE631F8D1646260754A3C73C896E0CE813971DBE438F7686ED7
Reporter abuse_ch
Tags:dll Gozi

Intelligence

File Origin
# of uploads :
1
# of downloads :
207
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Ursnif3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/111538/
Detection(s):
SecuriteInfo.com.Mal.EncPk-APV.20994.2160.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Using the Windows Management Instrumentation requests
Launching a process
Creating a window
DNS request
Searching for the window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Ursnif
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/579240
Signature
Found malware configuration
Writes or reads registry keys via WMI
Writes registry values via WMI
Yara detected Ursnif
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 338663 Sample: zQ32b1FVcL.dll Startdate: 12/01/2021 Architecture: WINDOWS Score: 64 33 Found malware configuration 2->33 35 Yara detected  Ursnif 2->35 6 loaddll32.exe 7 2->6         started        10 iexplore.exe 1 50 2->10         started        12 iexplore.exe 1 50 2->12         started        14 2 other processes 2->14 process3 dnsIp4 29 babidone.top 6->29 37 Writes or reads registry keys via WMI 6->37 39 Writes registry values via WMI 6->39 31 192.168.2.1 unknown unknown 10->31 16 iexplore.exe 28 10->16         started        19 iexplore.exe 31 12->19         started        21 iexplore.exe 36 14->21         started        23 iexplore.exe 31 14->23         started        signatures5 process6 dnsIp7 25 begoventa.top 47.91.89.242, 49746, 49747, 80 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC United States 16->25 27 babidone.top 193.56.255.166, 443, 80 INFOCLOUD-SRLMD Romania 19->27
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e5dc940537146c1c56b8a8f91234484c83223943c13d2fbf354f0cfdec13c258/
Threat name:
Win32.Trojan.ZLoader
Create hunting rule
Status:
Malicious
First seen:
2021-01-12 17:08:09 UTC
AV detection:
12 of 28 (42.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4xojibjxcrwbyvvyvd4rencijsbseokdye6s7pzvj4gp33atyjma._file
Verdict:
malicious
Similar samples:
00af5f13551c5e20fe29ec3d12dca555a56cd1edcd0a8633373872334de485ae
Gozi
0c84acf6d63976812d17da46fc3b8bf1128bbfd5f717262f20e25f3598484a9b
Gozi
0fb4779661fe23fdcd79c77fc74e721b637b496abe2eb26da28d12055af7b458
Gozi
2900169349643be6f77530141614eeac56e7b22387b9acf866ed4e4922e32401
Gozi
4d36701a7ece574dda56feaca4b70d9ee395ccf6c6522142028120b62324efc8
Gozi
550baac0b4b99acf919e29a691523acb8c1b88277b1d2f2340b2e9dc37f9110a
Gozi
8e34c697b603788b9baeecfb375c466cb8468a322d6ae9b81fc41fb61472c3da
Gozi
9cabfa3e674b0274b3b802695b49d9634e027fb15aa827afaf793104f7317690
Gozi
af5030e85147368bd9ad59c09a39cbf28ecde7c7fb93e5b659346f424b3593f3
Gozi
e33157d0b5973fb880934006b1427f5ad53ae3f471e81a9a8460772d7f5b3657
Gozi
+ 79 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210112-nw9z9fnpea/
Behaviour
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Unpacked files
SH256 hash:
af3d848a32f097bfb957918422c6cd0858f2da3d353bf30071ccbed446698dad
MD5 hash:
0f8aba5017e9117d8bb52eb3215d9240
SHA1 hash:
407330126bd5408a3215d1f89959d202ad871793
Detections:
win_isfb_auto
Create hunting rule
Link:
https://www.unpac.me/results/7b52262f-b893-465f-a0b0-d4987d91555c/
Parent samples :
8e34c697b603788b9baeecfb375c466cb8468a322d6ae9b81fc41fb61472c3da
e5dc940537146c1c56b8a8f91234484c83223943c13d2fbf354f0cfdec13c258
SH256 hash:
e5dc940537146c1c56b8a8f91234484c83223943c13d2fbf354f0cfdec13c258
MD5 hash:
eed4174c8a96dd7b611d9f109c71e20f
SHA1 hash:
c471724d86fd269a19932280361ca52e1e294f19
Link:
https://www.unpac.me/results/7b52262f-b893-465f-a0b0-d4987d91555c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.51
Link:
https://yomi.yoroi.company/submissions/e5dc940537146c1c56b8a8f91234484c83223943c13d2fbf354f0cfdec13c258

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ursnif3
Create hunting rule
Author:kevoreilly
Description:Ursnif Payload
Rule name:win_isfb_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gozi

DLL dll e5dc940537146c1c56b8a8f91234484c83223943c13d2fbf354f0cfdec13c258

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/952951/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/111538/

Comments