MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ebd73a3f010aa3cf01059a4c08f9f70d0d7d4d671e76d024e5dfd60b27e92a66. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 14


Intelligence 14 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ebd73a3f010aa3cf01059a4c08f9f70d0d7d4d671e76d024e5dfd60b27e92a66
SHA3-384 hash: 95a508628b80225d61af296c1f701cf80a030f479ca8abb8d0c546c818d07aebc47d5e086f2093a2c2498e837c4faf0d
SHA1 hash: 52443a01d8a4f68b0971e7439e2ce0cc7f0051ff
MD5 hash: 0acd60544d3348fa95341f10b1f26123
humanhash: hot-tango-single-ink
File name:gozi.dll
Download: download sample
Signature Gozi
Create hunting rule
File size:691'200 bytes
First seen:2023-06-06 18:42:38 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 4e300a8f3074b0a71c5ff4a85e11a4d6 (1 x Gozi)
ssdeep 12288:AioSAWNEDdnKh0TmR/Y+O1J5xr35OTal8Gc9RO8p8irjWHhIxF:AiHAWa1bmR/k1J5xr5OTal8GkRL8irjV
Threatray 209 similar samples on MalwareBazaar
TLSH T165E46A57DDC52F5BC63EC2720AEF89A218B5AA887F424607772CA561306335A7BC374C
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter fr0s7_
Tags:dll Gozi mikehp-com

Intelligence

File Origin
# of uploads :
1
# of downloads :
333
Origin country :
IT IT
Vendor Threat Intelligence
Detection:
UrsnifV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/396265/
Detection(s):
SecuriteInfo.com.Win32.BotX-gen.8729.32134.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware zusy
Link:
https://www.filescan.io/uploads/647f7e39ee44b2e387d4428c/reports/0b093d3a-c57f-46e9-bbb9-c5a5788495ac/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/ebd73a3f010aa3cf01059a4c08f9f70d0d7d4d671e76d024e5dfd60b27e92a66
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Ursnif
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4373beeb-9cf9-446f-822e-9ebae5eb52b1
Result
Threat name:
Ursnif
Create hunting rule
Detection:
malicious
Classification:
bank.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1249799
Signature
Allocates memory in foreign processes
Changes memory attributes in foreign processes to executable or writable
Creates a thread in another existing process (thread injection)
Disables SPDY (HTTP compression, likely to perform web injects)
Found malware configuration
Injects code into the Windows Explorer (explorer.exe)
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Sigma detected: Dot net compiler compiles file from suspicious location
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to steal Mail credentials (via file / registry access)
Writes or reads registry keys via WMI
Writes registry values via WMI
Writes to foreign memory regions
Yara detected Ursnif
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 882819 Sample: gozi.dll Startdate: 06/06/2023 Architecture: WINDOWS Score: 100 102 Snort IDS alert for network traffic 2->102 104 Found malware configuration 2->104 106 Malicious sample detected (through community Yara rule) 2->106 108 3 other signatures 2->108 8 loaddll32.exe 1 7 2->8         started        12 mshta.exe 2->12         started        14 mshta.exe 2->14         started        16 2 other processes 2->16 process3 dnsIp4 100 dretils.com 91.215.85.164, 49732, 49733, 49734 PINDC-ASRU Russian Federation 8->100 136 Writes to foreign memory regions 8->136 138 Writes or reads registry keys via WMI 8->138 140 Writes registry values via WMI 8->140 18 regsvr32.exe 6 8->18         started        22 cmd.exe 1 8->22         started        24 rundll32.exe 6 8->24         started        35 4 other processes 8->35 26 powershell.exe 12->26         started        29 powershell.exe 14->29         started        31 powershell.exe 16->31         started        33 powershell.exe 16->33         started        signatures5 process6 dnsIp7 94 dretils.com 18->94 110 System process connects to network (likely due to code injection or exploit) 18->110 112 Writes or reads registry keys via WMI 18->112 114 Writes registry values via WMI 18->114 37 rundll32.exe 6 22->37         started        96 dretils.com 24->96 41 control.exe 24->41         started        76 C:\Users\user\AppData\...\hywpowbj.cmdline, Unicode 26->76 dropped 116 Injects code into the Windows Explorer (explorer.exe) 26->116 118 Writes to foreign memory regions 26->118 120 Modifies the context of a thread in another process (thread injection) 26->120 43 explorer.exe 26->43 injected 45 csc.exe 26->45         started        48 2 other processes 26->48 122 Maps a DLL or memory area into another process 29->122 124 Creates a thread in another existing process (thread injection) 29->124 50 3 other processes 29->50 52 3 other processes 31->52 54 3 other processes 33->54 56 3 other processes 35->56 file8 signatures9 process10 dnsIp11 98 dretils.com 37->98 126 Writes registry values via WMI 37->126 58 control.exe 37->58         started        128 Tries to steal Mail credentials (via file / registry access) 43->128 130 Changes memory attributes in foreign processes to executable or writable 43->130 132 Writes to foreign memory regions 43->132 134 5 other signatures 43->134 78 C:\Users\user\AppData\Local\...\hywpowbj.dll, PE32 45->78 dropped 60 cvtres.exe 45->60         started        80 C:\Users\user\AppData\Local\...\cunbt4my.dll, PE32 48->80 dropped 62 cvtres.exe 48->62         started        82 C:\Users\user\AppData\Local\...\sqxl4cfh.dll, PE32 50->82 dropped 84 C:\Users\user\AppData\Local\...\d5cnksdm.dll, PE32 50->84 dropped 64 cvtres.exe 50->64         started        66 cvtres.exe 50->66         started        86 C:\Users\user\AppData\Local\...\vsfhohgf.dll, PE32 52->86 dropped 88 C:\Users\user\AppData\Local\...\sxmyae3h.dll, PE32 52->88 dropped 68 cvtres.exe 52->68         started        70 cvtres.exe 52->70         started        90 C:\Users\user\AppData\Local\...\th5guvwd.dll, PE32 54->90 dropped 92 C:\Users\user\AppData\Local\...\c0eqnivg.dll, PE32 54->92 dropped 72 cvtres.exe 54->72         started        74 cvtres.exe 54->74         started        file12 signatures13 process14
Detection:
gozi
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ebd73a3f010aa3cf01059a4c08f9f70d0d7d4d671e76d024e5dfd60b27e92a66/
Threat name:
Win32.Trojan.Ursnif
Create hunting rule
Status:
Malicious
First seen:
2023-06-06 18:43:07 UTC
File Type:
PE (Dll)
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5pltupybbkr46aiftjgar6pxbugx2tlhdz3najhf37lawj7jfjta._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
0423fd21a639d16d71c50b15fdf96b7e19690583b2aee6f25443329d0e8ea0eb
Gozi
06864a9cd9890f3c1aad6bdc5dfbfb799e68f5f90a99b6146ca70850d0a249a1
Gozi
54e1a7dc75b550786afcb0601020a2c50739347541cc8cb969acf76b90222458
Gozi
65f687a5c0e757cd8e296f8b0453b27726e5017502e93dcb8379d59fe9c056a3
Gozi
7ad0db9da1c28e6d12826b846ee3c82bda649e00d717cb2c4aefeaed56ea48ce
Gozi
8291f9579288153e0a1812c6c528563634c5c41b0916c606f7d8b4544ccc381a
Gozi
9c8d5a09d9f9634876274d50349dcc617ad7f354aad6e71762e08b089f40fec1
Gozi
d42f53c75818af4aae281a0c3f760e20643852405d69134d03f6ba5c62efe316
Gozi
d50570c1b4d064fb1f6e855d0c27ac1958a7a32c3cef5e6373094d82647f5bd4
Gozi
ea2d71af9790b0a058d0d166c52c2609a1a106053189c515b6059b5f18e9e48b
Gozi
+ 199 additional samples on MalwareBazaar
Result
Malware family:
gozi
Create hunting rule
Score:
  10/10
Tags:
family:gozi botnet:5050 banker isfb trojan
Link:
https://tria.ge/reports/230606-xcw86afa56/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Gozi
Malware Config
C2 Extraction:
https://fazz.bing.com/check
dretils.com
https://fazzd.bing.com/check
Unpacked files
SH256 hash:
7c53a30034a190f362488a8d57eeae159e52bae08e1db863037e6376b513db60
MD5 hash:
6e038e4e96d35fa12e57e7011e7682bc
SHA1 hash:
e38c91df5cb3286e1876bfa2760bd1dd5a9d5e2a
Link:
https://www.unpac.me/results/df7d04e5-0dd1-4c1e-98f4-e3f224f96d5e/
SH256 hash:
ebd73a3f010aa3cf01059a4c08f9f70d0d7d4d671e76d024e5dfd60b27e92a66
MD5 hash:
0acd60544d3348fa95341f10b1f26123
SHA1 hash:
52443a01d8a4f68b0971e7439e2ce0cc7f0051ff
Link:
https://www.unpac.me/results/df7d04e5-0dd1-4c1e-98f4-e3f224f96d5e/
Malware family:
Ursnif
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ebd73a3f010a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ebd73a3f010aa3cf01059a4c08f9f70d0d7d4d671e76d024e5dfd60b27e92a66

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_isfb_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.isfb.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/396265/

Comments