General
- Target b5b2765aaf97ae9c22abd312e684616d
- Size 820KB
- Sample210204-7ddakabam6
- SHA256 9f6d02b422cb72eb3bbc723b8b4a692bc9f641f1908b7e4b32685b2ad42fbef7
Score
10/10
Malware Config
Extracted
Family
-
gozi_ifsb
Botnet
-
2000
Attributes
-
build
215755
-
exe_type
worker
rsa_pubkey.base64
serpent.plain
Targets
-
- Target b5b2765aaf97ae9c22abd312e684616d
- Size 820KB
- SHA256 9f6d02b422cb72eb3bbc723b8b4a692bc9f641f1908b7e4b32685b2ad42fbef7
Score10/10-
Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
-
Windows security bypass
-
Windows security modification
-
Adds Run key to start application
-
Suspicious use of SetThreadContext