Overview

overview

10

Static

static

https___pu...hp.dll

windows7_x64

10

https___pu...hp.dll

windows10_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    https___purefile24.top_4352wedfoifom.php

  • Size

    545KB

  • Sample

    201125-aqm3kw87yj

  • MD5

    e221c9a4b1ac13310d037cbc764b86d9

  • SHA1

    a7dbb7283b3b164993c1c122189e42509fe5573d

  • SHA256

    6b1e27915fa85d6bde40c512865e57c555e7bb02f1dc192a9b827c74c8984780

  • SHA512

    56c649d6a79f68924fe55973836f51cb10bbf1ed82366ea3be9be4f8dbf8e56aa4a2aedd933fa977d2109fd9abd7ea947d77e40659f00c80f645a18580cbf12c

Score
10/10
gozi_ifsbursnifbankerspywaretrojan

Malware Config

Targets

    • Target

      https___purefile24.top_4352wedfoifom.php

    • Size

      545KB

    • MD5

      e221c9a4b1ac13310d037cbc764b86d9

    • SHA1

      a7dbb7283b3b164993c1c122189e42509fe5573d

    • SHA256

      6b1e27915fa85d6bde40c512865e57c555e7bb02f1dc192a9b827c74c8984780

    • SHA512

      56c649d6a79f68924fe55973836f51cb10bbf1ed82366ea3be9be4f8dbf8e56aa4a2aedd933fa977d2109fd9abd7ea947d77e40659f00c80f645a18580cbf12c

    Score
    10/10
    gozi_ifsbursnifbankerspywaretrojan

    • Gozi, Gozi IFSB

      Gozi ISFB is a well-known and widely distributed banking trojan.

      bankertrojangozi_ifsb

    • Ursnif, Dreambot

      Ursnif is a variant of the Gozi IFSB with more capabilities.

      bankertrojanursnif

    • ServiceHost packer

      Detects ServiceHost packer used for .NET malware

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks