🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f7a1ecdd925fd1e03ff08f547b24a10e64a5996060feab65e77f6ca0339b6a00. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gozi


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f7a1ecdd925fd1e03ff08f547b24a10e64a5996060feab65e77f6ca0339b6a00
SHA3-384 hash: 94a2ed39003271ce616948782b5ff0c4d29465fd8e70a0c39dcb2f2f4fc22806a85d65169ff81afe92527337e08a73cf
SHA1 hash: 6b71978633aa2f91c15ef48eaf3cc4dd54ea7dd0
MD5 hash: d7b3fe9b94d3896df9d9f77b37adbf37
humanhash: nine-two-item-music
File name:d7b.dll
Download: download sample
Signature Gozi
Create hunting rule
File size:177'664 bytes
First seen:2021-07-09 13:22:00 UTC
Last seen:2021-07-09 13:37:33 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash ac619a5e9649fa4ff2fcaed7df41e611 (1 x Gozi)
ssdeep 3072:dCIks3iqbneE3yl7w51ftkvWpos24f8DauYpEwDSQ9pFq7mvY:3RSqb5201V60K4f8DanDSAFU
Threatray 265 similar samples on MalwareBazaar
TLSH T1D104C01137F08832F1B3673488B49123996EBDB5D770D48B29C1256F0AB62D58E7877B
Reporter 0x746f6d6669
Tags:dll Gozi

Intelligence

File Origin
# of uploads :
2
# of downloads :
325
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Ursnif3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/170679/
Detection(s):
SecuriteInfo.com.Trojan.Gozi.578.13836.29787.UNOFFICIAL
Create hunting rule

Malware family:
Ursnif
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5bb79675-0231-4ea1-ba16-257095870336
Result
Threat name:
Ursnif
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/814008
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Writes or reads registry keys via WMI
Writes registry values via WMI
Yara detected Ursnif
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 446419 Sample: d7b.dll Startdate: 09/07/2021 Architecture: WINDOWS Score: 88 42 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->42 44 Antivirus / Scanner detection for submitted sample 2->44 46 Multi AV Scanner detection for submitted file 2->46 48 3 other signatures 2->48 7 loaddll32.exe 1 2->7         started        10 iexplore.exe 1 53 2->10         started        12 iexplore.exe 1 53 2->12         started        14 iexplore.exe 1 54 2->14         started        process3 signatures4 50 Writes or reads registry keys via WMI 7->50 52 Writes registry values via WMI 7->52 16 rundll32.exe 7->16         started        19 cmd.exe 1 7->19         started        21 iexplore.exe 33 10->21         started        24 iexplore.exe 29 10->24         started        26 iexplore.exe 12->26         started        28 iexplore.exe 12->28         started        30 iexplore.exe 28 14->30         started        32 iexplore.exe 26 14->32         started        process5 dnsIp6 40 Writes registry values via WMI 16->40 34 rundll32.exe 19->34         started        36 ooakieyrc.xyz 139.59.150.28, 49746, 49747, 49748 DIGITALOCEAN-ASNUS Singapore 21->36 38 81.92.202.190, 80 M247GB United Kingdom 26->38 signatures7 process8
Detection:
isfb
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f7a1ecdd925fd1e03ff08f547b24a10e64a5996060feab65e77f6ca0339b6a00/
Threat name:
Win32.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2021-07-05 21:46:41 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=66q6zxmsl7i6ap7qr5khwjfbbzsklglamd7kwzphp5wkam43niaa._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
2bd5a5a663b3a2818136ba7f1b3c431c50de70e70416b9bcdce3fee23ee3353e
Gozi
3ab79263ec3e73bdfb8ef6c93e33622b8529de1cf78d4e6f008368a16139aa18
Gozi
50f44ecaffeb0f59b600806e04ac963fe549c431400aa6951619f75b690a771e
Gozi
590a4e2feb9a028416299be8bc8969de93fcbff442e6c0585b18646b8458fc0a
Gozi
7aa84b4ce4fbf937632d3008981c3ef8ff63e1ff846fdbb55060f3973d2507a9
Gozi
b9871f825034194cde293d56401ce6ddfba60ba57e95dd14bab2565bfce5c087
Gozi
c85d0da5fe543408376ed6c916d5e498aadc0b5f75be0ddc59a4efe3da5fff07
Gozi
ceafed22728ab72aa4a74dc2fc96d54b85ec0432ef0c97a4497075cc802109d3
Gozi
dc0df8f5ee0e898e069643a84cbc8154d6191f081665e245f1a9e2085028062f
Gozi
eec9887fb0a1a6157c82c1319dd32e9750d616a4dc31cdbb29b2ff75028fcf04
Gozi
+ 255 additional samples on MalwareBazaar
Result
Malware family:
gozi_ifsb
Create hunting rule
Score:
  10/10
Tags:
family:gozi_ifsb botnet:3006 banker trojan
Link:
https://tria.ge/reports/210709-qn2hfz8er2/
Behaviour
Suspicious use of WriteProcessMemory
Gozi, Gozi IFSB
Malware Config
C2 Extraction:
google.com
gmail.com
ooakieyrc.xyz
81.92.202.190
Unpacked files
SH256 hash:
f7a1ecdd925fd1e03ff08f547b24a10e64a5996060feab65e77f6ca0339b6a00
MD5 hash:
d7b3fe9b94d3896df9d9f77b37adbf37
SHA1 hash:
6b71978633aa2f91c15ef48eaf3cc4dd54ea7dd0
Link:
https://www.unpac.me/results/37dc0ea3-9da5-47f3-ae04-fa488c5d4466/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f7a1ecdd925fd1e03ff08f547b24a10e64a5996060feab65e77f6ca0339b6a00

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ursnif3
Create hunting rule
Author:kevoreilly
Description:Ursnif Payload
Rule name:win_isfb_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.isfb.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/170679/

Comments