gozi_ifsb | b725a6e174cd448a720f179599290d3f014fd2d1521b8de1ddcf28193ba8d09f

Analysis

Target
2200.dll
Size 380KB
Sample210302-1aeb4a8vln
SHA256 b725a6e174cd448a720f179599290d3f014fd2d1521b8de1ddcf28193ba8d09f
MD5 649b5c913739cea195c7662ff412b8ce
SHA1 0f727f35cded239371681678545328a25014c92e
SHA512 009740ff83446711a414e158abf8957108733bfdd9037503a0767f0885ed71c09695fa6f200c2eb0aec1d161ba31f09b508b86b1c6652dc3c35196169dd30886
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Attributes

rsa_pubkey.base64

serpent.plain

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 492 wrote to memory of 3124	492	regsvr32.exe	71
PID 492 wrote to memory of 3124	492	regsvr32.exe	71
PID 492 wrote to memory of 3124	492	regsvr32.exe	71

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2200.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:492
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2200.dll
  2⤵
  PID:3124

memory/3124-3-0x00000000736B0000-0x00000000736BF000-memory.dmp

Download

memory/3124-4-0x00000000029F0000-0x00000000029F1000-memory.dmp

Download