Overview

overview

10

Static

static

job_attach_h6x.js

windows7_x64

10

job_attach_h6x.js

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    job_attach_h6x.js

  • Size

    1.3MB

  • Sample

    200417-vgrh6xlvl2

  • MD5

    c9a6a820f7d344bfd42471b9964049a8

  • SHA1

    bdc1669dec4e00d2d76817379b7b5088fadb471b

  • SHA256

    385f77e0604e9926408a261fb3e56268f60e0fda4f124f2d1b0c1b45d106bdc0

  • SHA512

    8b5d2d1ad55b942a5158036530c7c92cdb7318b4e878ff4d3e31d891b5b4a874914860c708d056b0033872cff006ce542ebdd79d04d13249e9c63c7f2622fa8f

Score
10/10
gozi_ifsbursnifbankerevasionspywaretrojan

Malware Config

Targets

    • Target

      job_attach_h6x.js

    • Size

      1.3MB

    • MD5

      c9a6a820f7d344bfd42471b9964049a8

    • SHA1

      bdc1669dec4e00d2d76817379b7b5088fadb471b

    • SHA256

      385f77e0604e9926408a261fb3e56268f60e0fda4f124f2d1b0c1b45d106bdc0

    • SHA512

      8b5d2d1ad55b942a5158036530c7c92cdb7318b4e878ff4d3e31d891b5b4a874914860c708d056b0033872cff006ce542ebdd79d04d13249e9c63c7f2622fa8f

    Score
    10/10
    bankertrojangozi_ifsbursnifspywareevasion

    • Gozi, Gozi IFSB

      Gozi ISFB is a well-known and widely distributed banking trojan.

      bankertrojangozi_ifsb

    • Ursnif, Dreambot

      Ursnif is a variant of the Gozi IFSB with more capabilities.

      bankertrojanursnif

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks