Overview

overview

10

Static

static

view_prese...o0k.js

windows7_x64

10

view_prese...o0k.js

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    view_presentation_o0k.js

  • Size

    1.3MB

  • Sample

    200418-wpdrs478cs

  • MD5

    aa23220bc3897c8f3248f93e28291757

  • SHA1

    5e630080abbfcb85d15d60aaf6560dfd5e0c4efd

  • SHA256

    c3798c2190c4929eefccf38dbcd703cd83c6209de2ac98ae7421b2469ae71426

  • SHA512

    2fe1a6476288a7249cdf81c89fb7215034e5cd2999bd26e6cfdadb601e9ac6cb13590c309dbe2c6fbba5a63690eb60e25f68746b4e0adda20cf7f3cd63b48a55

Score
10/10
gozi_ifsbursnifbankerevasionspywaretrojan

Malware Config

Targets

    • Target

      view_presentation_o0k.js

    • Size

      1.3MB

    • MD5

      aa23220bc3897c8f3248f93e28291757

    • SHA1

      5e630080abbfcb85d15d60aaf6560dfd5e0c4efd

    • SHA256

      c3798c2190c4929eefccf38dbcd703cd83c6209de2ac98ae7421b2469ae71426

    • SHA512

      2fe1a6476288a7249cdf81c89fb7215034e5cd2999bd26e6cfdadb601e9ac6cb13590c309dbe2c6fbba5a63690eb60e25f68746b4e0adda20cf7f3cd63b48a55

    Score
    10/10
    bankertrojanursnifspywareevasiongozi_ifsb

    • Gozi, Gozi IFSB

      Gozi ISFB is a well-known and widely distributed banking trojan.

      bankertrojangozi_ifsb

    • Ursnif, Dreambot

      Ursnif is a variant of the Gozi IFSB with more capabilities.

      bankertrojanursnif

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks