gozi_ifsb | 3b56b7298c366a323d28658a455abf0d4e78fa197a43ce13bedab05f26901d34 | Triage

Sharing

General

Target

609a460e94791.tiff.dll
Size

821KB
Sample

210511-etcfzphx4a
MD5

50a299d1e92d9205e123404c8e05904d
SHA1

c188272ab757dbbf14e74781fc90fcefe4aeb615
SHA256

3b56b7298c366a323d28658a455abf0d4e78fa197a43ce13bedab05f26901d34
SHA512

ec30f36d70ddbb6ba4aaccb3342e0a0ffbd586d2784370500a94e33aa650d1c56d3712ffc3a9e15a0558194ce26d1b76d9f2a8953220684bef634e57f4579df1

Score

10^/10

gozi_ifsb 8877 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

8877

C2

outlook.com/login

gmail.com

worunekulo.club

horunekulo.website

Attributes

build
250196
dga_season
10
exe_type
loader
server_id
12

rsa_pubkey.base64

serpent.plain

Targets

- Target
  
  609a460e94791.tiff.dll
- Size
  
  821KB
- MD5
  
  50a299d1e92d9205e123404c8e05904d
- SHA1
  
  c188272ab757dbbf14e74781fc90fcefe4aeb615
- SHA256
  
  3b56b7298c366a323d28658a455abf0d4e78fa197a43ce13bedab05f26901d34
- SHA512
  
  ec30f36d70ddbb6ba4aaccb3342e0a0ffbd586d2784370500a94e33aa650d1c56d3712ffc3a9e15a0558194ce26d1b76d9f2a8953220684bef634e57f4579df1
Score

10^/10

gozi_ifsb 8877 banker trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

gozi_ifsb8877bankertrojan

behavioral2

gozi_ifsb8877bankertrojan