Overview

overview

10

Static

static

presentation_p1f.js

windows7_x64

10

presentation_p1f.js

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    presentation_p1f.js

  • Size

    1.3MB

  • Sample

    200417-1s1flaja3x

  • MD5

    5024d780ce83091c9e3ec1501b1cce19

  • SHA1

    4f9c3b9aa21a5a4b638eef3902d26f2f562a0ed5

  • SHA256

    55a1a3a43322e94c4a2d9363a72aec52b16b7fc591f23601de1cfcb85559558c

  • SHA512

    96b888f75ac39d56510f8f3aac763bb32182a69c77f649b6349789d84f848ea2057d54a4b3e72ae3318c47814edb4311c57d93add609eb9e2c0334c3e8f5d2ba

Score
10/10
gozi_ifsbursnifbankerdiscoveryevasionspywaretrojan

Malware Config

Targets

    • Target

      presentation_p1f.js

    • Size

      1.3MB

    • MD5

      5024d780ce83091c9e3ec1501b1cce19

    • SHA1

      4f9c3b9aa21a5a4b638eef3902d26f2f562a0ed5

    • SHA256

      55a1a3a43322e94c4a2d9363a72aec52b16b7fc591f23601de1cfcb85559558c

    • SHA512

      96b888f75ac39d56510f8f3aac763bb32182a69c77f649b6349789d84f848ea2057d54a4b3e72ae3318c47814edb4311c57d93add609eb9e2c0334c3e8f5d2ba

    Score
    10/10
    bankertrojangozi_ifsbursnifdiscoveryevasionspyware

    • Gozi, Gozi IFSB

      Gozi ISFB is a well-known and widely distributed banking trojan.

      bankertrojangozi_ifsb

    • Ursnif, Dreambot

      Ursnif is a variant of the Gozi IFSB with more capabilities.

      bankertrojanursnif

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Checks for installed software on the system

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks