gozi_ifsb | d0c6a4b3d920ff9efb4150c7b59de59497baf32f6c92ffd570a5406633665702

General

Target

d0c6a4b3d920ff9efb4150c7b59de59497baf32f6c92ffd570a5406633665702
Size

327KB
Sample

201113-z915sc3wva
MD5

2e2ed2b2bc917a92eb0d9bdb466da3b9
SHA1

f361d57f199c8a75c8e92b5ff0385e978cda0e53
SHA256

d0c6a4b3d920ff9efb4150c7b59de59497baf32f6c92ffd570a5406633665702
SHA512

7011c2fea9a87c19b86ce4fff579a7e73796ea9fc4474880ef0f84801f86a37b385b54cb271dc486f38ff3fd6f1727d0ac640e7155f1fa297b80e61e360fa844

Score

10^/10

Malware Config

Targets

- Target
  
  d0c6a4b3d920ff9efb4150c7b59de59497baf32f6c92ffd570a5406633665702
- Size
  
  327KB
- MD5
  
  2e2ed2b2bc917a92eb0d9bdb466da3b9
- SHA1
  
  f361d57f199c8a75c8e92b5ff0385e978cda0e53
- SHA256
  
  d0c6a4b3d920ff9efb4150c7b59de59497baf32f6c92ffd570a5406633665702
- SHA512
  
  7011c2fea9a87c19b86ce4fff579a7e73796ea9fc4474880ef0f84801f86a37b385b54cb271dc486f38ff3fd6f1727d0ac640e7155f1fa297b80e61e360fa844
Score

10^/10

gozi_ifsb ursnif banker persistence spyware trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
- Ursnif, Dreambot
  Ursnif is a variant of the Gozi IFSB with more capabilities.
  banker trojan ursnif
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Gozi, Gozi IFSB

Ursnif, Dreambot

Executes dropped EXE

Deletes itself

Loads dropped DLL

Reads user/profile data of web browsers

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2