🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f16b2871155bd4898cd02cbb8bffe7ee7770acf0b7577c66c334f71dc2394471. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f16b2871155bd4898cd02cbb8bffe7ee7770acf0b7577c66c334f71dc2394471
SHA3-384 hash: 67ef85d1731d5ee1bb91112b5a02f25c0fb4694dabbd8f4ff87bc32227cc452ccdaf478225a5173340ca3c019f8c9c56
SHA1 hash: d7419f45bf40e43c8ce00aa8338972294a79c93f
MD5 hash: 98798af20f74f09d6b5abf2f31a22ff3
humanhash: spaghetti-queen-october-stairway
File name:98798af20f74f09d6b5abf2f31a22ff3
Download: download sample
Signature Gozi
Create hunting rule
File size:32'768 bytes
First seen:2023-01-13 16:20:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 41d47768be27a1b9dc153c47ae3e0cb7 (1 x Gozi)
ssdeep 768:ct6/PJRlNhSP00p7Prw0P4cIGA0ryWP5suw5zc:X/PJ7NhSP00ZPU0mv47q
Threatray 3'865 similar samples on MalwareBazaar
TLSH T1F5E21847736504ECC67692BCC9535B22D2B2BC401725B7CF83E1826A0FB67E1B97AB50
TrID 44.4% (.EXE) Win64 Executable (generic) (10523/12/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter zbetcheckin
Tags:exe Gozi

Intelligence

File Origin
# of uploads :
1
# of downloads :
200
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
98798af20f74f09d6b5abf2f31a22ff3
Verdict:
No threats detected
Analysis date:
2023-01-13 16:23:28 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a6d7a72d-e9f4-4f65-95f0-5b3fcb4b8c77

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/352659/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.64878702.28390.28812.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/60070/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
No Threat
Threat level:
  2/10
Confidence:
67%
Link:
https://www.filescan.io/uploads/63c184f0de614a115a160579/reports/034d099b-76b5-4f2e-bb18-978ab4258f3c/overview
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/703caeea-38af-4c74-be8d-c06a334cf09e
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1151236
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to inject threads in other processes
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 783967 Sample: l1qn62V1kG.exe Startdate: 13/01/2023 Architecture: WINDOWS Score: 60 13 Antivirus / Scanner detection for submitted sample 2->13 15 Multi AV Scanner detection for submitted file 2->15 6 l1qn62V1kG.exe 1 2->6         started        process3 signatures4 17 Contains functionality to inject threads in other processes 6->17 9 conhost.exe 6->9         started        11 cmd.exe 1 6->11         started        process5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f16b2871155bd4898cd02cbb8bffe7ee7770acf0b7577c66c334f71dc2394471/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-01-10 04:11:12 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
17 of 39 (43.59%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6fvsq4ivlpkitdgqfs5yx77h5z3xblhqw5lxyzwdgt3r3qrziryq._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
1baf63a128c8adbb4598a456ddcb81b33042e06f9cdb99e51448643b6f88cc6d
Gozi
2ba9d1f00b6c9eae7b5328afd6bd6e1561e4d6a831209f94d1f631ebffa72d9c
Gozi
3d50fb7a6d59a7b4a4779f5d4b804442133038d5b9afe845b3aad5f2631d2437
Gozi
3e7752596a9dfb8bc7c2d3039132b1f1e6bf2ca0585769fc09f5f6bf9e5c7b8a
Gozi
4cb0b838560c4e859b8aa29c40fffde2f196a827eda7f69a2b766299651c50df
Gozi
8cbf3b568724d618057aab89ae62d13436c75d4a5306388a932bbe7c287ae08e
Gozi
984ad5e9c502cd45ac4c0c425a2d374d558c0786098208a7094f7240ae40a555
Gozi
a3d391dac8cecf22acc946063a6c0afe18d3778cbdfc168b96b67fe5c15d9494
Gozi
cbafa6b5a5a5141801e04ad135271a9e0169e120582ed96c4136c0b2b2ae4d98
Gozi
ec5ab723a255e763e9c87a23d44794b70108b988c7053432177d5dadafd7e645
Gozi
+ 3'855 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/230113-ttm52aeb3s/
Behaviour
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
f16b2871155bd4898cd02cbb8bffe7ee7770acf0b7577c66c334f71dc2394471
MD5 hash:
98798af20f74f09d6b5abf2f31a22ff3
SHA1 hash:
d7419f45bf40e43c8ce00aa8338972294a79c93f
Link:
https://www.unpac.me/results/12dfa4d2-f84e-4d50-8aa1-696a511d458e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f16b2871155bd4898cd02cbb8bffe7ee7770acf0b7577c66c334f71dc2394471

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gozi

Executable exe f16b2871155bd4898cd02cbb8bffe7ee7770acf0b7577c66c334f71dc2394471

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2506754/
Cape
Cape
https://www.capesandbox.com/analysis/352659/

Comments


Avatar
zbet commented on 2023-01-13 16:20:57 UTC

url : hxxp://instankc.beget.tech/dhjsfgiyweu/eufhrdkghfaugscdhjgsadfygdasyfg/Injector-x64.exe