MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f1a8e6bb2bd7668c5434717ea9582b75b37e5ed3c2ca616acea379c667ba348b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f1a8e6bb2bd7668c5434717ea9582b75b37e5ed3c2ca616acea379c667ba348b
SHA3-384 hash:	8ba05ee4c80185c24ff2ab84f4a333a1e96388df6a4c535feb20c72b6992a4ec49e6495dd04532c4e841dd02c870323b
SHA1 hash:	e85f288b05434089c825f40311095e51ea5ea652
MD5 hash:	cd5a07afe0fa9b3a2b680e2d81b5b4e0
humanhash:	batman-saturn-fifteen-pizza
File name:	cd.dll
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	129'977 bytes
First seen:	2023-10-09 14:10:36 UTC
Last seen:	2023-10-09 14:54:56 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	4591971c64bf15dce063b12b334ce943 (1 x Gozi)
ssdeep	1536:AjqjP5p9i0e7dfWsaAoQ9MSIgts2Xr9cWl2b4gA6Z:AOfeRuaRImsg9328gAI
Threatray	682 similar samples on MalwareBazaar
TLSH	T1ECC3BE5669694CF9C0D370391AB466D0AB88DA50E233817DB729CCFEBD2FFC314A1546
TrID	45.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.3% (.EXE) OS/2 Executable (generic) (2029/13) 18.0% (.EXE) Generic Win/DOS Executable (2002/3) 18.0% (.EXE) DOS Executable Generic (2000/1)
Reporter	0x746f6d6669
Tags:	dll Gozi

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

340

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win32.BotX-gen.12899.18393.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

FileScan.io

Gathering data

Hybrid Analysis Malware

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/f1a8e6bb2bd7668c5434717ea9582b75b37e5ed3c2ca616acea379c667ba348b

Intezer Ursnif

Malware family:

Ursnif

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/8812559b-5f43-43f7-aef4-15cb2250d39a

Joe Sandbox Dridex Dropper, Ursnif

Result

Threat name:

Dridex Dropper, Ursnif

Alert

Create hunting rule

Detection:

malicious

Classification:

bank.troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1322232

Signature

Antivirus detection for URL or domain

Dridex dropper found

Found API chain indicative of debugger detection

Found evasive API chain (may stop execution after checking system information)

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Writes registry values via WMI

Yara detected Ursnif

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f1a8e6bb2bd7668c5434717ea9582b75b37e5ed3c2ca616acea379c667ba348b/

ReversingLabs TitaniumCloud Win32.Trojan.Zenpak

Threat name:

Win32.Trojan.Zenpak

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-06-12 14:51:14 UTC

File Type:

PE (Dll)

AV detection:

25 of 38 (65.79%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6guonozl25tiyvbuof7kswblowzx4xwtylfgc2woun44mz52gsfq._file

Threatray gozi

Verdict:

malicious

Label(s):

gozi

Alert

Create hunting rule

Similar samples:

58b0cd8e48f0a3b226f33aa51c0265000c6d029462539aefc58b0021a68c2f23

Gozi

7bed2fb3176716bd5f0a077cf8a670f6dbdf9d90d0091dc40a25f7c7bf4ab038

Gozi

8291f9579288153e0a1812c6c528563634c5c41b0916c606f7d8b4544ccc381a

Gozi

9c8d5a09d9f9634876274d50349dcc617ad7f354aad6e71762e08b089f40fec1

Gozi

d42f53c75818af4aae281a0c3f760e20643852405d69134d03f6ba5c62efe316

Gozi

ebd73a3f010aa3cf01059a4c08f9f70d0d7d4d671e76d024e5dfd60b27e92a66

Gozi

+ 672 additional samples on MalwareBazaar

Hatching Triage gozi

Result

Malware family:

gozi

Alert

Create hunting rule

Score:

  10/10

Tags:

family:gozi botnet:199675 banker isfb trojan

Link:

https://tria.ge/reports/231009-rg9r6adc6x/

Behaviour

Suspicious use of WriteProcessMemory

Blocklisted process makes network request

Gozi

Malware Config

C2 Extraction:

https://list.check.bin1g.com
https://listwhite.ch1eck.yahoo.com
http://45.155.249.170
http://91.242.217.120
http://170.130.55.65
http://79.132.130.230
https://listwhite1.check.yahoo.com
https://listwhite.che1ck.yah1oo.com
http://94.247.42.100
http://45.155.250.58
https://list.check.bing.com
http://45.155.249.91

UnpacMe ISFB_Main win_isfb_auto

Unpacked files

SH256 hash:

2f99514266d5268c892f87135880a403f605e3347977ea82436a6fe109220427

MD5 hash:

f8ea802e7f28b638c9b640a8e8238863

SHA1 hash:

66591a9b0a08c3bd6b5fb41eec85615799a020c6

Detections:

ISFB_Main

Alert

Create hunting rule

win_isfb_auto

Alert

Create hunting rule

Link:

https://www.unpac.me/results/31e26cca-b96f-4285-9d1e-0c489c3e2e18/

SH256 hash:

b5ac2e4e643502546f693dbe7261d5d3b1898450915655b6aa6f69f30d3d581c

MD5 hash:

0d8fdef3815fe342bb1d38139e9972a3

SHA1 hash:

9da5a2b5f3253238b24bfff84d7d013b11bfe544

Link:

https://www.unpac.me/results/31e26cca-b96f-4285-9d1e-0c489c3e2e18/

SH256 hash:

f1a8e6bb2bd7668c5434717ea9582b75b37e5ed3c2ca616acea379c667ba348b

MD5 hash:

cd5a07afe0fa9b3a2b680e2d81b5b4e0

SHA1 hash:

e85f288b05434089c825f40311095e51ea5ea652

Link:

https://www.unpac.me/results/31e26cca-b96f-4285-9d1e-0c489c3e2e18/

VMRay Ursnif

Malware family:

Ursnif

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/f1a8e6bb2bd7/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI ursnif3

Threat name:

ursnif3

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f1a8e6bb2bd7668c5434717ea9582b75b37e5ed3c2ca616acea379c667ba348b