MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f139bc8f71a483ba058e2577ef5952b85a74cebd302632a121e4bbc0d96bb953. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f139bc8f71a483ba058e2577ef5952b85a74cebd302632a121e4bbc0d96bb953
SHA3-384 hash:	c66c8ee138693349b8f471a8b6541ea94015c5bfbb139f704886dec7d63fc25c37b63593d3d326df5787e95ce93b8e91
SHA1 hash:	b9c43085f6b63db8a02b4764c4d75699efa9d074
MD5 hash:	386839452984e2eda4151746d57ea19b
humanhash:	blossom-maryland-table-undress
File name:	server.exe
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	182'784 bytes
First seen:	2023-03-20 14:04:31 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b6299cf22bb1b2b906c76a98a991dd84 (5 x Smoke Loader, 5 x RedLineStealer, 2 x Gozi)
ssdeep	3072:tQPCdvNZmiJN2CE91O6lbP+pnW6ya2wPAnBb4:SavnKO6lz6Tyatw
Threatray	66 similar samples on MalwareBazaar
TLSH	T102048EC353A0BC51F4158A368E2EC2F8671EFC91CE5DAB66E2096F2F48BD162C572741
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	0042022409011524 (1 x Gozi)
Reporter	JAMESWT_WT
Tags:	agenziaentrate exe Gozi isfb MEF mise Ursnif

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

267

Origin country :

IT

Vendor Threat Intelligence

ANY.RUN

Malware family:

n/a

ID:

1

File name:

server.exe

Verdict:

No threats detected

Analysis date:

2023-03-20 14:05:26 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/cb95ccf2-08ed-4543-9998-891e433b3e39

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/375957/

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Searching for the window

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

azorult greyware lockbit manuscrypt mikey packed smokeloader

Link:

https://www.filescan.io/uploads/6418681228f6cfd59136c95d/reports/52d0f368-2bb0-4ad5-80c4-b29108354556/overview

Hybrid Analysis Mikey.Generic

Verdict:

Malicious

Labled as:

Mikey.Generic

Link:

https://www.hybrid-analysis.com/sample/f139bc8f71a483ba058e2577ef5952b85a74cebd302632a121e4bbc0d96bb953

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Ursnif

Malware family:

Ursnif

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ae533b42-589b-4714-80a4-5ec898a2aabb

Joe Sandbox Ursnif

Result

Threat name:

Ursnif

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1197753

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found API chain indicative of debugger detection

Found evasive API chain (may stop execution after checking system information)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Writes or reads registry keys via WMI

Writes registry values via WMI

Yara detected Ursnif

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB gozi

Detection:

gozi

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/f139bc8f71a483ba058e2577ef5952b85a74cebd302632a121e4bbc0d96bb953/

ReversingLabs TitaniumCloud Win32.Trojan.RedLineStealer

Threat name:

Win32.Trojan.RedLineStealer

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-03-20 14:03:30 UTC

File Type:

PE (Exe)

Extracted files:

29

AV detection:

21 of 24 (87.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6e43zd3rusb3ubmoev366wksxbnhjtv5gatdfijb4s54bwllxfjq._file

Threatray gozi

Verdict:

malicious

Label(s):

gozi

Alert

Create hunting rule

Similar samples:

05b73bccd726df4df86b10b00b2ed4d6e6ba9832e3b473dd7abe6c50c8d5bfbf

Gozi

0fa7c98d793b8c71d6ba29bde4fd449e497b246f92ab30403330fae3d8cb6ffd

Gozi

236f2a9fcc1176a802946828029465d054626f92d258015f8abccdc52d2365e7

Gozi

3aa75da2773573786f07530f5a09b8e0aacd0402fd11e14d8067b5f4607bbd6a

Gozi

7c854a125b0d2613bbfcd1fb3664c03c61bc3787ec8bde6be11a2f75692da268

Gozi

9d1e71b94eab825c928377e93377feb62e02a85b7d750b883919207119a56e0d

Gozi

a6886a3566a1a98072d67f1aca4a04b5667f97f4df21b2f54d6108293d7c02b7

Gozi

a9934cc506821e82237fdaf471f845e1e027b37841d635f971b8df6853e9d7f9

Gozi

b97cfd0ea14f390894948861cacafbad2f88767d52477e339e2c0a6e4316793b

Gozi

+ 56 additional samples on MalwareBazaar

Hatching Triage gozi

Result

Malware family:

gozi

Alert

Create hunting rule

Score:

  10/10

Tags:

family:gozi botnet:7715 banker isfb trojan

Link:

https://tria.ge/reports/230320-rdvh3afh2w/

Behaviour

Gozi

Malware Config

C2 Extraction:

checklist.skype.com
62.173.142.81
193.233.175.113
109.248.11.184
212.109.218.26
185.68.93.7

UnpacMe ISFB_Main win_isfb_auto

Unpacked files

SH256 hash:

c817c7b9f76c27fd90036b3b97784d922d6807169083adab7e218eb3df087945

MD5 hash:

d12d8721c6a233f0f65ab81c09422842

SHA1 hash:

8e5903a416826333c6aebd86f995e3fe7ff748b8

Link:

https://www.unpac.me/results/d2454552-1f2d-42c0-8ad9-155d63137392/

SH256 hash:

ba1a5cd9f9c292c667a0d4d577cf66afe813b9fa838752c67ea6363e5b36c841

MD5 hash:

90b6cdfe9896972ccee348859f8e173d

SHA1 hash:

53bce0dabc905d8aa32c9aacfdbf74bf705c8946

Detections:

ISFB_Main

Alert

Create hunting rule

win_isfb_auto

Alert

Create hunting rule

Link:

https://www.unpac.me/results/d2454552-1f2d-42c0-8ad9-155d63137392/

Parent samples :

a6886a3566a1a98072d67f1aca4a04b5667f97f4df21b2f54d6108293d7c02b7
0fa7c98d793b8c71d6ba29bde4fd449e497b246f92ab30403330fae3d8cb6ffd
3aa75da2773573786f07530f5a09b8e0aacd0402fd11e14d8067b5f4607bbd6a
a9934cc506821e82237fdaf471f845e1e027b37841d635f971b8df6853e9d7f9
b97cfd0ea14f390894948861cacafbad2f88767d52477e339e2c0a6e4316793b
f139bc8f71a483ba058e2577ef5952b85a74cebd302632a121e4bbc0d96bb953
308110773533c5740fd92d77094da83152f98230cd9635bc8f7dcd7dce910c75

SH256 hash:

f139bc8f71a483ba058e2577ef5952b85a74cebd302632a121e4bbc0d96bb953

MD5 hash:

386839452984e2eda4151746d57ea19b

SHA1 hash:

b9c43085f6b63db8a02b4764c4d75699efa9d074

Link:

https://www.unpac.me/results/d2454552-1f2d-42c0-8ad9-155d63137392/

VMRay Ursnif

Malware family:

Ursnif

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/f139bc8f71a4/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f139bc8f71a483ba058e2577ef5952b85a74cebd302632a121e4bbc0d96bb953

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/375957/