gozi_ifsb | 419e1f52d1dd72ef9e9d2af16124abcaa2cc889389bbb10bb8d1fa23276ba697 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
2223108b78386fb1e01d0ebd47429254.dll
Size 937KB
Sample210428-llsq1srd8a
SHA256 419e1f52d1dd72ef9e9d2af16124abcaa2cc889389bbb10bb8d1fa23276ba697
MD5 2223108b78386fb1e01d0ebd47429254
SHA1 42ba1dea99956340c037439e2af4689bec82b721
SHA512 62bb22d2db73af9c83fbc3fbdcd41d954384f5d1aff7ac69decabe9d05a5a03129c32555304155b14452c0a5f41129d48e8347c5ae9c1c73475ae69863c7bb44
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 4500 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

4500

C2

app3.maintorna.com
chat.billionady.com
app5.folion.xyz
wer.defone.click

Attributes

build
250188
exe_type
loader
server_id
580

rsa_pubkey.base64

serpent.plain

Targets

- Target
  2223108b78386fb1e01d0ebd47429254.dll
- Size 937KB
- SHA256 419e1f52d1dd72ef9e9d2af16124abcaa2cc889389bbb10bb8d1fa23276ba697
- MD5 2223108b78386fb1e01d0ebd47429254
- SHA1 42ba1dea99956340c037439e2af4689bec82b721
- SHA512 62bb22d2db73af9c83fbc3fbdcd41d954384f5d1aff7ac69decabe9d05a5a03129c32555304155b14452c0a5f41129d48e8347c5ae9c1c73475ae69863c7bb44
- MD5 SHA1 SHA512
Score

10^/10

gozi_ifsb 4500 banker trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

gozi_ifsb4500bankertrojan