gozi_ifsb | a641898f8ab7f0777ed407ecdc8e96eee463374d4c121791980ad101c60abe5e | Triage

Sharing

General

Target

overt.tbz2
Size

266KB
Sample

210325-ga7w1eb4me
MD5

02bfdba77f85e65624f2b609f752e8d6
SHA1

11b6d450612065ec292164a62e10347e50f17b16
SHA256

a641898f8ab7f0777ed407ecdc8e96eee463374d4c121791980ad101c60abe5e
SHA512

a7e723bffc88a747c821cd004dd6f99f5a750c00de5454967acc1df0cabef30c5526ef4631e6e104e2dc02b97f083855008755d93979c5c2010c55a59069d79b

Score

10^/10

gozi_ifsb 2200 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

2200

C2

api10.laptok.at/api1

golang.feel500.at/api1

go.in100k.at/api1

Attributes

build
250180
exe_type
loader
server_id
730

rsa_pubkey.base64

serpent.plain

Targets

- Target
  
  overt.tbz2
- Size
  
  266KB
- MD5
  
  02bfdba77f85e65624f2b609f752e8d6
- SHA1
  
  11b6d450612065ec292164a62e10347e50f17b16
- SHA256
  
  a641898f8ab7f0777ed407ecdc8e96eee463374d4c121791980ad101c60abe5e
- SHA512
  
  a7e723bffc88a747c821cd004dd6f99f5a750c00de5454967acc1df0cabef30c5526ef4631e6e104e2dc02b97f083855008755d93979c5c2010c55a59069d79b
Score

10^/10

gozi_ifsb 2200 banker trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

gozi_ifsb2200bankertrojan