gozi_ifsb | c18e2c68d372caf4cfd5ead1dcfe93d369a93fdc9198c76152283c4e747ecad5

General

Target

tr_9.xls
Size

90KB
Sample

200714-sm534pfz62
MD5

9cf44f1dd44ea313a0d931130ebb1aaf
SHA1

0243be928d28f5b75d4d58af445b6d1b0350ee2c
SHA256

c18e2c68d372caf4cfd5ead1dcfe93d369a93fdc9198c76152283c4e747ecad5
SHA512

e7644dfae5808829f6d5ee129ff2e250da1dd257a3657becec472a562404aa12b6e7ab7b6eba5d93e4a39b02e89afa0b16a08e89adb150e271548bcd3cc9516f

Score

10^/10

Malware Config

Targets

- Target
  
  tr_9.xls
- Size
  
  90KB
- MD5
  
  9cf44f1dd44ea313a0d931130ebb1aaf
- SHA1
  
  0243be928d28f5b75d4d58af445b6d1b0350ee2c
- SHA256
  
  c18e2c68d372caf4cfd5ead1dcfe93d369a93fdc9198c76152283c4e747ecad5
- SHA512
  
  e7644dfae5808829f6d5ee129ff2e250da1dd257a3657becec472a562404aa12b6e7ab7b6eba5d93e4a39b02e89afa0b16a08e89adb150e271548bcd3cc9516f
Score

10^/10

banker trojan ursnif evasion spyware gozi_ifsb discovery rat stealer pony
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Ursnif, Dreambot
  Ursnif is a variant of the Gozi IFSB with more capabilities.
  banker trojan ursnif
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Checks for installed software on the system
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies system certificate store
  evasion spyware trojan
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2