Overview

overview

10

Static

static

SecuriteIn...04.exe

windows7_x64

10

SecuriteIn...04.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Win32.Kryptik.HEME.26904

  • Size

    346KB

  • Sample

    200627-5hjj3mb3n2

  • MD5

    f577fbb7280758f98ad523a7b580d818

  • SHA1

    0c3262702dfec0ab6c305ab5126ee72b44eece07

  • SHA256

    00bd4de4ad3ccb503cb3e46030055454905d2a4033c03a462fd755af96edab27

  • SHA512

    d7d49d21710cf43050b9caa339462b63b20fb6419b129e37ad1e5b6c1675ab2bb33c70957dff612df9b47506d5c7b0f6f387f37c8377dfe294a713c7bff7a5ad

Score
10/10
gozi_ifsbursnifbankerspywaretrojan

Malware Config

Targets

    • Target

      SecuriteInfo.com.Win32.Kryptik.HEME.26904

    • Size

      346KB

    • MD5

      f577fbb7280758f98ad523a7b580d818

    • SHA1

      0c3262702dfec0ab6c305ab5126ee72b44eece07

    • SHA256

      00bd4de4ad3ccb503cb3e46030055454905d2a4033c03a462fd755af96edab27

    • SHA512

      d7d49d21710cf43050b9caa339462b63b20fb6419b129e37ad1e5b6c1675ab2bb33c70957dff612df9b47506d5c7b0f6f387f37c8377dfe294a713c7bff7a5ad

    Score
    10/10
    bankertrojangozi_ifsbursnifspyware

    • Gozi, Gozi IFSB

      Gozi ISFB is a well-known and widely distributed banking trojan.

      bankertrojangozi_ifsb

    • Ursnif, Dreambot

      Ursnif is a variant of the Gozi IFSB with more capabilities.

      bankertrojanursnif

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks