gozi_ifsb | 2dbf55098bbfc12d8366e80b682bd5dfac4a328470d6b00bd0d5eec7e989cb6c

Analysis

Target
preview.jpg.dll
Size 459KB
Sample210302-wefk84rj7a
SHA256 2dbf55098bbfc12d8366e80b682bd5dfac4a328470d6b00bd0d5eec7e989cb6c
MD5 2de7b395e585c5a1656c0979d903819e
SHA1 3f3ebebc3c15663a6566090a025924a0d075cdd8
SHA512 442d571fd1ff4f1226d1efbbf8f21658aefc5a50746c545cf6d48f8d1da7a5528280f0efe5f2166917a052bb21c413a88ec7bec80fb7cfa26ad597f7ca99fe6b
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Attributes

rsa_pubkey.base64

serpent.plain

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 2776	648	regsvr32.exe	74
PID 648 wrote to memory of 2776	648	regsvr32.exe	74
PID 648 wrote to memory of 2776	648	regsvr32.exe	74

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\preview.jpg.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:648
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\preview.jpg.dll
  2⤵
  PID:2776

memory/2776-3-0x0000000074190000-0x000000007419F000-memory.dmp

Download

memory/2776-4-0x0000000001080000-0x0000000001081000-memory.dmp

Download