gozi_ifsb | 1abd2ae7b4600681751fcd1d401a6ad35fbdd3e231790be49ef7b61333358802

Analysis

Target
6064024521dc9.png.dll
Size 264KB
Sample210331-apjgy6jdcs
SHA256 1abd2ae7b4600681751fcd1d401a6ad35fbdd3e231790be49ef7b61333358802
MD5 114344b10fcf51c14d79e5441e8fa86a
SHA1 1d52817634967190aa11a5c1eee9917839f4f384
SHA512 3cf4279d16e0022a500c578bee2b5976f947d5ff213090c2fa1d3a702168a0cd5c0e7fa789224d921638faec7f25c01f967c8fb4f0deeaffb6ae78f029a99d87
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Attributes

rsa_pubkey.base64

serpent.plain

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 4776	4688	regsvr32.exe	69
PID 4688 wrote to memory of 4776	4688	regsvr32.exe	69
PID 4688 wrote to memory of 4776	4688	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6064024521dc9.png.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6064024521dc9.png.dll
  2⤵
  PID:4776

memory/4776-3-0x0000000073820000-0x000000007382F000-memory.dmp

Download

memory/4776-4-0x0000000000440000-0x0000000000441000-memory.dmp

Download