gozi_ifsb | 9f6d02b422cb72eb3bbc723b8b4a692bc9f641f1908b7e4b32685b2ad42fbef7

Resubmissions

04-02-2021 15:57

210204-7ddakabam6 10

25-01-2021 14:31

210125-8btrv6fz22 10

22-01-2021 07:56

210122-t6s44f1q3n 10

14-12-2020 16:08

201214-rvlc1zsl7x 10

Sharing

Copy URL

Twitter E-mail

General

Target

b5b2765aaf97ae9c22abd312e684616d
Size

820KB
Sample

201214-rvlc1zsl7x
MD5

b5b2765aaf97ae9c22abd312e684616d
SHA1

a66a652c2067f7489b83aba3b78502c0f482863b
SHA256

9f6d02b422cb72eb3bbc723b8b4a692bc9f641f1908b7e4b32685b2ad42fbef7
SHA512

af6c0a6c582a0cfd4f7de6bf1cf0199898b31edc0dba5467a499c2148e425d91d556bd7eebd08faf093d610cbf2afbee2237affc206106c7209cb2492a563279

Score

10^/10

Malware Config

Targets

- Target
  
  b5b2765aaf97ae9c22abd312e684616d
- Size
  
  820KB
- MD5
  
  b5b2765aaf97ae9c22abd312e684616d
- SHA1
  
  a66a652c2067f7489b83aba3b78502c0f482863b
- SHA256
  
  9f6d02b422cb72eb3bbc723b8b4a692bc9f641f1908b7e4b32685b2ad42fbef7
- SHA512
  
  af6c0a6c582a0cfd4f7de6bf1cf0199898b31edc0dba5467a499c2148e425d91d556bd7eebd08faf093d610cbf2afbee2237affc206106c7209cb2492a563279
Score

10^/10

gozi_ifsb ursnif banker evasion persistence spyware trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
- Suspicious use of NtCreateProcessExOtherParentProcess
- Ursnif, Dreambot
  Ursnif is a variant of the Gozi IFSB with more capabilities.
  banker trojan ursnif
- Windows security bypass
  evasion trojan
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Gozi, Gozi IFSB

Suspicious use of NtCreateProcessExOtherParentProcess

Ursnif, Dreambot

Windows security bypass

Reads user/profile data of web browsers

Windows security modification

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2