MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2bf00d0e3d2462f9d02f4e5f9583cd7c445fac183fa7b417652bb175c609bb2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f2bf00d0e3d2462f9d02f4e5f9583cd7c445fac183fa7b417652bb175c609bb2
SHA3-384 hash:	ba5aa7464262f8492ee0b557488cbcd179e36a63642db583f088052fe02187e563cdf76c4622a03eb3ed99667c419c1d
SHA1 hash:	5ce33e2bb3346565e222cc3d1c9110e3fe1292d7
MD5 hash:	e932d727fb2a88835d822316bde5ab89
humanhash:	sierra-shade-wolfram-nitrogen
File name:	script
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	209 bytes
First seen:	2022-12-07 04:39:38 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	3:SnfYkh4ktQwgD2adAwLXHPtwrWFFdAFEeIAYRmRLIUApLsVB+xMeFk9eOD6L4A78:efxHOwUbCWmFvGw24+s9e06kHf5mXyn
TLSH	T1AFD023551E05FDF5C0400BC9FF179C14D42319E40906E63083CD4C89A421408D7DDC76
Reporter	JAMESWT_WT
Tags:	agenziaentrate agenziaonline-top Gozi Loader ps1 script Ursnif

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

264

Origin country :

IT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.PowerShell.DownLoader.3.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

powershell

Link:

https://www.filescan.io/uploads/6390192404e0e79bdf4138cc/reports/965d8084-dbd1-4829-a3e3-739eaeb83e12/overview

Joe Sandbox malicious

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1129682

Signature

Antivirus detection for URL or domain

Snort IDS alert for network traffic

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f2bf00d0e3d2462f9d02f4e5f9583cd7c445fac183fa7b417652bb175c609bb2/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6k7qbuhd2jdc7hic6ts7swb427cel6wbqp5hwqlwkk5roxdatoza._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

n/a

Link:

https://tria.ge/reports/221207-jjnzgagb62/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Blocklisted process makes network request

Malware Config

Dropper Extraction:

http://onlineagenzia.top/registr.dll

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.20

Link:

https://yomi.yoroi.company/submissions/f2bf00d0e3d2462f9d02f4e5f9583cd7c445fac183fa7b417652bb175c609bb2