MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb44943385bba67eff81794d2f5667817a6761f13775149c615a543c0e78186c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eb44943385bba67eff81794d2f5667817a6761f13775149c615a543c0e78186c
SHA3-384 hash: 635cdbfbacd11b44b45b24a87031a76a99d093562e933b5c73d70015ef2dcf8f5e7402dda0214a989aef9f8f3f9028ea
SHA1 hash: d32fa44ff6090aff739ce5ad471245bdb9a65a72
MD5 hash: 1fb95166dda235cb6e5279db1b72722a
humanhash: video-stream-five-fruit
File name:vozuxigapemor vipikagasu.exe
Download: download sample
Signature Gozi
Create hunting rule
File size:218'112 bytes
First seen:2022-02-02 10:09:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash bde21746025c70053eefc929ff6a27da (1 x ArkeiStealer, 1 x Gozi)
ssdeep 3072:OVEObdBDEmiLptmDHhy59M92VOWcFZ25Dz8sLrT:gEGDPiLnmDUMYwWOo5H8wX
Threatray 10'553 similar samples on MalwareBazaar
TLSH T1DD24CF0D7B90C032C44E2634192CCBA19B3BBC726976A657B77617BF5F322D19B26306
File icon (PE):PE icon
dhash icon fcfcb4b4b4d4d9c1 (24 x RedLineStealer, 10 x Smoke Loader, 4 x RaccoonStealer)
Reporter JAMESWT_WT
Tags:Emergenza COVID-19 exe Gozi isfb Ursnif

Intelligence

File Origin
# of uploads :
1
# of downloads :
427
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2nd.exe
Verdict:
Malicious activity
Analysis date:
2022-02-02 09:08:57 UTC
Tags:
trojan gozi ursnif dreambot evasion
Link:
https://app.any.run/tasks/14383320-4e3d-4dff-a9be-3ebb31d42dbe

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/229928/
Detection(s):
Win.Malware.Generic-9938273-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Using the Windows Management Instrumentation requests
Launching a process
Searching for synchronization primitives
Сreating synchronization primitives
Creating a window
Sending an HTTP GET request
Searching for the window
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/5778/overview
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
CPUID_Instruction
EvasionGetTickCount
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/61fa587f18d1bfdde4eaa174/reports/52d46e80-af81-4104-954a-64611f6ff1d9/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Ursnif
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/dc4f5734-8d92-4268-a151-20692fcd6935
Result
Threat name:
Ursnif
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/932630
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eb44943385bba67eff81794d2f5667817a6761f13775149c615a543c0e78186c/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2022-02-02 10:10:14 UTC
File Type:
PE (Exe)
Extracted files:
14
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5ncjim4fxoth574bpfgs6vthqf5goyprg52rjhdbljkdydtydbwa._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
0acb5fbfce22e58b189d929de7dfb805c0725ecd9f3bd3ef8674c60fdd4ad72f
Gozi
0f54e3a74da4ee2efba60740d755ae9764d9ba2327cd1f2b5c9ba55a8051745d
Gozi
2b7c46cb10900dd2840380802ed77aa77c337265cd9b3fcdeaf85361dc92525c
Gozi
4aa09b674fd1735d46c0996770c0bffedba87249bf9d62664a7f44a00f6306fa
Gozi
599a59aba0c234edc2c2799a7a06208d3d112438b1bc49ba5292f111429b9102
Gozi
ca2a87b0664849a8f35d69cabebb190ca348c84db69196c9a3da45952bc16905
Gozi
dd21593b3a97f03f8cf6ee5065690486a277ed070bf3250ff7b0dd695a1e85d1
Gozi
+ 10'543 additional samples on MalwareBazaar
Gathering data
Unpacked files
SH256 hash:
8e82a5bdd5fd278a9ce1f2710e775818e44467ea4bd85045c7d7f55a7a8d9aa4
MD5 hash:
09df681b9ba2729e9dff87b800941a39
SHA1 hash:
cb55545c688cd297bdc063d90dd1058a381c798d
Detections:
win_isfb_auto
Create hunting rule
Link:
https://www.unpac.me/results/e5c5109f-3992-4986-8b98-3719589100ce/
SH256 hash:
ee175617a0cae85e88dac5c1cdf48f698d09900cbb30d671bb5c7d6bc7e22dad
MD5 hash:
57f9211a83bee1f2b06feea97d6ad587
SHA1 hash:
2861858ab664679ca77fb70bf829435bdc27a0df
Detections:
win_isfb_auto
Create hunting rule
Link:
https://www.unpac.me/results/e5c5109f-3992-4986-8b98-3719589100ce/
SH256 hash:
eb44943385bba67eff81794d2f5667817a6761f13775149c615a543c0e78186c
MD5 hash:
1fb95166dda235cb6e5279db1b72722a
SHA1 hash:
d32fa44ff6090aff739ce5ad471245bdb9a65a72
Link:
https://www.unpac.me/results/e5c5109f-3992-4986-8b98-3719589100ce/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/eb44943385bba67eff81794d2f5667817a6761f13775149c615a543c0e78186c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_isfb_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.isfb.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/229928/

Comments