Overview

overview

10

Static

static

b5b2765aaf...6d.dll

windows7_x64

10

b5b2765aaf...6d.dll

windows10_x64

10

Resubmissions

04-02-2021 15:57

210204-7ddakabam6 10

25-01-2021 14:31

210125-8btrv6fz22 10

22-01-2021 07:56

210122-t6s44f1q3n 10

14-12-2020 16:08

201214-rvlc1zsl7x 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b5b2765aaf97ae9c22abd312e684616d

  • Size

    820KB

  • Sample

    201214-rvlc1zsl7x

  • MD5

    b5b2765aaf97ae9c22abd312e684616d

  • SHA1

    a66a652c2067f7489b83aba3b78502c0f482863b

  • SHA256

    9f6d02b422cb72eb3bbc723b8b4a692bc9f641f1908b7e4b32685b2ad42fbef7

  • SHA512

    af6c0a6c582a0cfd4f7de6bf1cf0199898b31edc0dba5467a499c2148e425d91d556bd7eebd08faf093d610cbf2afbee2237affc206106c7209cb2492a563279

Score
10/10
gozi_ifsbursnifbankerevasionpersistencespywaretrojan

Malware Config

Targets

    • Target

      b5b2765aaf97ae9c22abd312e684616d

    • Size

      820KB

    • MD5

      b5b2765aaf97ae9c22abd312e684616d

    • SHA1

      a66a652c2067f7489b83aba3b78502c0f482863b

    • SHA256

      9f6d02b422cb72eb3bbc723b8b4a692bc9f641f1908b7e4b32685b2ad42fbef7

    • SHA512

      af6c0a6c582a0cfd4f7de6bf1cf0199898b31edc0dba5467a499c2148e425d91d556bd7eebd08faf093d610cbf2afbee2237affc206106c7209cb2492a563279

    Score
    10/10
    gozi_ifsbursnifbankerevasionpersistencespywaretrojan

    • Gozi, Gozi IFSB

      Gozi ISFB is a well-known and widely distributed banking trojan.

      bankertrojangozi_ifsb

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Ursnif, Dreambot

      Ursnif is a variant of the Gozi IFSB with more capabilities.

      bankertrojanursnif

    • Windows security bypass

      evasiontrojan

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks