gozi_ifsb | 9969cfd81612d1efbc5e983b57ff2fa2a69a3f6a6812c6da8382bf0c22014cf4 | Triage

Sharing

General

Target

presentation.dll
Size

310KB
Sample

210505-7dfp1hrln6
MD5

9debcd929765390555ca123c0076eea4
SHA1

d0c68d1d874a877dbbbce1fea0bb164c6bdad642
SHA256

9969cfd81612d1efbc5e983b57ff2fa2a69a3f6a6812c6da8382bf0c22014cf4
SHA512

6c81556e2438ee04d5fae0e0b069d1558c2ab0fa2023915dad80203cca62b16f6dcf797bd58c854cfa5fdb113bf831cf2f7a040a287a66efa9637f64c35fd9ab

Score

10^/10

gozi_ifsb 1500 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

1500

C2

app.buboleinov.com

chat.veminiare.com

chat.billionady.com

app3.maintorna.com

Attributes

build
250188
exe_type
loader
server_id
580

rsa_pubkey.base64

serpent.plain

Targets

- Target
  
  presentation.dll
- Size
  
  310KB
- MD5
  
  9debcd929765390555ca123c0076eea4
- SHA1
  
  d0c68d1d874a877dbbbce1fea0bb164c6bdad642
- SHA256
  
  9969cfd81612d1efbc5e983b57ff2fa2a69a3f6a6812c6da8382bf0c22014cf4
- SHA512
  
  6c81556e2438ee04d5fae0e0b069d1558c2ab0fa2023915dad80203cca62b16f6dcf797bd58c854cfa5fdb113bf831cf2f7a040a287a66efa9637f64c35fd9ab
Score

10^/10

gozi_ifsb 1500 banker trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

gozi_ifsb1500bankertrojan

behavioral2

gozi_ifsb1500bankertrojan