gozi_ifsb | 35375028a2cc4876b5a8476876ad75a037b8c4e303589ce6e9d9c61aaba9f74c

Analysis

Target
deli.png.dll
Size 264KB
Sample210302-bj89jvs9va
SHA256 35375028a2cc4876b5a8476876ad75a037b8c4e303589ce6e9d9c61aaba9f74c
MD5 225969564af689a1c330bf8e095281ff
SHA1 bcd1b29c7faf778be8eece7faf1b42e13b6030d9
SHA512 413f110a04403cdb0a14a336d25bffe3d71965a566b2e92b0225fff2a9a6750bd401aa94a0ac493b2206506fc7eab5360d7ddd3c1bee0b5162f7da9e44e047e0
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Attributes

rsa_pubkey.base64

serpent.plain

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 1712	740	regsvr32.exe	72
PID 740 wrote to memory of 1712	740	regsvr32.exe	72
PID 740 wrote to memory of 1712	740	regsvr32.exe	72

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\deli.png.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:740
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\deli.png.dll
  2⤵
  PID:1712

memory/1712-4-0x0000000000400000-0x0000000000540000-memory.dmp

Download

memory/1712-3-0x0000000004E80000-0x0000000004E81000-memory.dmp

Download