gozi_ifsb | 310ac7c48b536f71a16706f67fd4d2bed5d9f5708dd460cf3cbc0cd34f43a3ed

Analysis

Target
7e98e8fbf2fec9c9d36896a08a26a97f.dll
Size 372KB
Sample210330-wcqfltlde2
SHA256 310ac7c48b536f71a16706f67fd4d2bed5d9f5708dd460cf3cbc0cd34f43a3ed
MD5 7e98e8fbf2fec9c9d36896a08a26a97f
SHA1 d3c22e099df48f78765bba4b64e3f006a9e0bcdd
SHA512 6d56845449783147539c38f6418bd2387c92c4bb0fba9040c8130db8c6097cf77557a924337541798dd3b3c1ff5aab00864479867cddcd2512e83bdac963decd
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Attributes

rsa_pubkey.base64

serpent.plain

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 3744	880	regsvr32.exe	74
PID 880 wrote to memory of 3744	880	regsvr32.exe	74
PID 880 wrote to memory of 3744	880	regsvr32.exe	74

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7e98e8fbf2fec9c9d36896a08a26a97f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7e98e8fbf2fec9c9d36896a08a26a97f.dll
  2⤵
  PID:3744

memory/3744-3-0x0000000073310000-0x000000007331F000-memory.dmp

Download

memory/3744-4-0x0000000000B60000-0x0000000000B61000-memory.dmp

Download