MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff69d250cc705f583350967cc8956786e198d2ab5cbaa6e19fc63b1e2a208ac7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gozi

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	ff69d250cc705f583350967cc8956786e198d2ab5cbaa6e19fc63b1e2a208ac7
SHA3-384 hash:	0093920fcfe902442df65ddf59d1801969764bca0965dc48bd026beed8d81746d3d6dacc0bea11767575f6f78e2a8562
SHA1 hash:	4e567696df314efdb3c0bb182677ab82f511bf2b
MD5 hash:	15edbc82e59fd8a6c0c90d3db539c4c8
humanhash:	pip-double-october-eight
File name:	header[1].jpg.dll
Download:	download sample
Signature	Gozi Create hunting rule
File size:	391'024 bytes
First seen:	2021-02-08 08:34:17 UTC
Last seen:	2021-02-08 08:34:37 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	a772111560b66004e6e750154e97bb74 (1 x Gozi)
ssdeep	6144:EViAfGZvYO/K9zWVB2ZYpp1gbKXflHvXcd0xrZv4fk6GFzGzC:IbkYv9zWyZKzgbKvxvXcd0nvD
Threatray	1 similar samples on MalwareBazaar
TLSH	C8845B5734D7C132E321C5BED4896BF6B9645E90AB0974B767D03EEFB8330A246E0252
Reporter	JAMESWT_WT
Tags:	dll Gozi isfb mise signed Ursnif

Code Signing Certificate

Organisation:	Symantec Corporation
Issuer:	VeriSign Class 3 Code Signing 2004 CA
Algorithm:	sha1WithRSAEncryption
Valid from:	2007-10-31T00:00:00Z
Valid to:	2010-11-24T23:59:59Z
Serial number:	758f5ee8263b6694719d8434eb998608
Intelligence:	4 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:	SHA256
Thumbprint:	f67dda8679c10547d47fbc3bd71d98953d4f73fc60c50035e6f366e3da6395c2
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

309

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

SPAM.zip

Verdict:

Malicious activity

Analysis date:

2021-02-08 08:19:18 UTC

Tags:

trojan gozi ursnif dreambot loader

Link:

https://app.any.run/tasks/5b0c8484-04e7-4f2a-a5d0-988da9b37510

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Ursnif3

Link:

https://www.capesandbox.com/analysis/116019/

Detection(s):

SecuriteInfo.com.Gen.NN.ZedlaF.34804.x89@aWIQp7oi.13685.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Sending a UDP request

Using the Windows Management Instrumentation requests

Launching a process

Creating a window

DNS request

Deleting a recently created file

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ff69d250cc705f583350967cc8956786e198d2ab5cbaa6e19fc63b1e2a208ac7/

Threat name:

Win32.Trojan.Ursnif

Status:

Malicious

First seen:

2021-02-08 08:34:10 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

22 of 29 (75.86%)

Threat level:

5/5

Verdict:

malicious

Gozi

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/210208-3z626nw4n6/

Behaviour

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Unpacked files

SH256 hash:

ff69d250cc705f583350967cc8956786e198d2ab5cbaa6e19fc63b1e2a208ac7

MD5 hash:

15edbc82e59fd8a6c0c90d3db539c4c8

SHA1 hash:

4e567696df314efdb3c0bb182677ab82f511bf2b

Link:

https://www.unpac.me/results/bd398306-b32b-4c81-b8f9-09f25eb6a7e8/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Cryptor

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ff69d250cc705f583350967cc8956786e198d2ab5cbaa6e19fc63b1e2a208ac7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.