Overview

overview

10

Static

static

invoice_or...st.exe

windows7_x64

10

invoice_or...st.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    invoice_order0045234_last.exe

  • Size

    232KB

  • Sample

    200803-6mwsgtg99j

  • MD5

    9ff1bb99a84f6efa175b721a37d14af7

  • SHA1

    ae9707f52f46ef38f686d755b22ad3a2d041e3cf

  • SHA256

    8b79bc15e6fa66285b46d5859e9c3fd784ec3b0dd7bcc41becd0b2b1a864cdf9

  • SHA512

    836c0a584fa255ca69dc1f6df2cb81ab0788bf2ad3306d3f95ba1963293066b2dc3c297c965ef0d13f41e105110ce75aa2aa6f3c209f9db6a8a52fe3aea68d80

Score
10/10
gozi_ifsbursnifbankerspywaretrojan

Malware Config

Targets

    • Target

      invoice_order0045234_last.exe

    • Size

      232KB

    • MD5

      9ff1bb99a84f6efa175b721a37d14af7

    • SHA1

      ae9707f52f46ef38f686d755b22ad3a2d041e3cf

    • SHA256

      8b79bc15e6fa66285b46d5859e9c3fd784ec3b0dd7bcc41becd0b2b1a864cdf9

    • SHA512

      836c0a584fa255ca69dc1f6df2cb81ab0788bf2ad3306d3f95ba1963293066b2dc3c297c965ef0d13f41e105110ce75aa2aa6f3c209f9db6a8a52fe3aea68d80

    Score
    10/10
    bankertrojangozi_ifsbursnifspyware

    • Gozi, Gozi IFSB

      Gozi ISFB is a well-known and widely distributed banking trojan.

      bankertrojangozi_ifsb

    • Ursnif, Dreambot

      Ursnif is a variant of the Gozi IFSB with more capabilities.

      bankertrojanursnif

    • ServiceHost packer

      Detects ServiceHost packer used for .NET malware

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks