gozi_ifsb | e81869620b9a18c3702c7be2fcf2e170cbc5c3de1ddbc84ae1fe190b57e917a0 | Triage

Sharing

General

Target

1752fe2b8419be8241ecd08859a5800f.dll
Size

821KB
Sample

210511-glyf4sa22s
MD5

1752fe2b8419be8241ecd08859a5800f
SHA1

eb7346a6d5a53ddaf8fd073f266c64d642b40a7d
SHA256

e81869620b9a18c3702c7be2fcf2e170cbc5c3de1ddbc84ae1fe190b57e917a0
SHA512

0718e566bdec828d59890818a65af53f467d1bab92abbdd2ecfe3eca55be7ad3692793e4310ea41f2ab2a9f5e9fe6d29e1873cacc1614c6f2cceaf6b320c8f15

Score

10^/10

gozi_ifsb 8877 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

8877

C2

outlook.com/login

gmail.com

worunekulo.club

horunekulo.website

Attributes

build
250196
dga_season
10
exe_type
loader
server_id
12

rsa_pubkey.base64

serpent.plain

Targets

- Target
  
  1752fe2b8419be8241ecd08859a5800f.dll
- Size
  
  821KB
- MD5
  
  1752fe2b8419be8241ecd08859a5800f
- SHA1
  
  eb7346a6d5a53ddaf8fd073f266c64d642b40a7d
- SHA256
  
  e81869620b9a18c3702c7be2fcf2e170cbc5c3de1ddbc84ae1fe190b57e917a0
- SHA512
  
  0718e566bdec828d59890818a65af53f467d1bab92abbdd2ecfe3eca55be7ad3692793e4310ea41f2ab2a9f5e9fe6d29e1873cacc1614c6f2cceaf6b320c8f15
Score

10^/10

gozi_ifsb 8877 banker trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

gozi_ifsb8877bankertrojan

behavioral2

gozi_ifsb8877bankertrojan