gozi_ifsb | 71f08e9b72d2349a42b7b594a2589eed621ae0f7f581406cfcc76f7d367c9590

General

Target

tr_6.xls
Size

90KB
Sample

200714-772ps1rbn2
MD5

a9da58b136b998405015544f03a31626
SHA1

63450e902625e771f03056ca104c146c49cecb89
SHA256

71f08e9b72d2349a42b7b594a2589eed621ae0f7f581406cfcc76f7d367c9590
SHA512

acbcdbe8070e3f073e6046216ffed61785a15cb5e69a1fd70c86193a0a5ecebcb3780e063038479fb35640f8cd0640f764b5e0b93f042b448224a10f1060f261

Score

10^/10

Malware Config

Targets

- Target
  
  tr_6.xls
- Size
  
  90KB
- MD5
  
  a9da58b136b998405015544f03a31626
- SHA1
  
  63450e902625e771f03056ca104c146c49cecb89
- SHA256
  
  71f08e9b72d2349a42b7b594a2589eed621ae0f7f581406cfcc76f7d367c9590
- SHA512
  
  acbcdbe8070e3f073e6046216ffed61785a15cb5e69a1fd70c86193a0a5ecebcb3780e063038479fb35640f8cd0640f764b5e0b93f042b448224a10f1060f261
Score

10^/10

evasion spyware trojan discovery banker gozi_ifsb rat stealer pony ursnif
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Ursnif, Dreambot
  Ursnif is a variant of the Gozi IFSB with more capabilities.
  banker trojan ursnif
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Checks for installed software on the system
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies system certificate store
  evasion spyware trojan
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2