MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 ec59616b1c80951d6597d4f25a9c031be0391151dc1073a5bece466473f0bdfe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Gozi
Vendor detections: 5
| SHA256 hash: | ec59616b1c80951d6597d4f25a9c031be0391151dc1073a5bece466473f0bdfe |
|---|---|
| SHA3-384 hash: | d8d52a1948dcc39d529d87370619f8ae29b70acb0a6f90509933b67d3e46bbcb91c12b2496ca2c6e31be4886208f9105 |
| SHA1 hash: | e75fd448fd430ebe8f4c1687ee5fb7f4561f5f3e |
| MD5 hash: | d294c892c0e092752d9173f4dc6b467d |
| humanhash: | papa-artist-march-montana |
| File name: | dwqiodwqiodjwqdojop1.vob |
| Download: | download sample |
| Signature | Gozi |
| File size: | 3'023'360 bytes |
| First seen: | 2023-07-12 13:48:55 UTC |
| Last seen: | 2024-09-03 06:50:57 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | d8cf501f2ead6a968abf3df1e5f5d366 (3 x Gozi, 2 x WikiLoader) |
| ssdeep | 49152:0EFD9UfWifI29mfKQnMg2XgEl7MV/yTm:OU9yTm |
| Threatray | 1 similar samples on MalwareBazaar |
| TLSH | T1ABE54A4562AD84E1E07B90BDD6DFBA1FF5213408071096CB06E44A9D6F33FE94BBA721 |
| TrID | 89.2% (.CPL) Windows Control Panel Item (generic) (197083/11/60) 4.7% (.EXE) Win64 Executable (generic) (10523/12/4) 2.2% (.EXE) Win16 NE executable (generic) (5038/12/1) 0.9% (.ICL) Windows Icons Library (generic) (2059/9) 0.9% (.EXE) OS/2 Executable (generic) (2029/13) |
| Reporter |  k3dg3___ |
| Tags: | exe Gozi Ursnif WikiLoader WikiLoaderGozi |
Intelligence
File Origin
# of uploads :
2
# of downloads :
344
Origin country :
USVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
dwqiodwqiodjwqdojop1.vob
Verdict:
No threats detected
Analysis date:
2023-07-12 13:49:59 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Searching for the window
Verdict:
No Threat
Threat level:
2/10
Confidence:
100%
Tags:
greyware masquerade
Verdict:
Unknown
Result
Threat name:
n/a
Detection:
clean
Classification:
n/a
Score:
6 / 100
Behaviour
Behavior Graph:
n/a
Threat name:
Win64.Trojan.Generic
Status:
Suspicious
First seen:
2023-07-12 13:49:06 UTC
File Type:
PE+ (Dll)
AV detection:
3 of 24 (12.50%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
unknown
Result
Malware family:
n/a
Score:
3/10
Tags:
n/a
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
ec59616b1c80951d6597d4f25a9c031be0391151dc1073a5bece466473f0bdfe
MD5 hash:
d294c892c0e092752d9173f4dc6b467d
SHA1 hash:
e75fd448fd430ebe8f4c1687ee5fb7f4561f5f3e
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
1d1e2c0946cd4e22fff380a3b6adf38e7c8b3f2947db7787d00f7d9db988dad2
Dropped by
SHA256 1d1e2c0946cd4e22fff380a3b6adf38e7c8b3f2947db7787d00f7d9db988dad2
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.