gozi_ifsb | 2765ba57873f9e68e5ca7946f24a941dd6625a3b2f489138a9eaa247cc0c2a12 | Triage

Sharing

General

Target

27d30f9286874b4fe184ffed6bd36a68.dll
Size

937KB
Sample

210619-bkrtmcntm2
MD5

27d30f9286874b4fe184ffed6bd36a68
SHA1

4641f931d1bcfb33fb591d651a88fb0bb17bba93
SHA256

2765ba57873f9e68e5ca7946f24a941dd6625a3b2f489138a9eaa247cc0c2a12
SHA512

352830196009f9e6b89b333b2e5d4f62f1f60a1d156ab36c175c9218f34db426c570bc9e708e2969b236abb27921d79917641ed83c212308897f1cdb96279c1a

Score

10^/10

gozi_ifsb 4500 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

4500

C2

app3.maintorna.com

chat.billionady.com

app5.folion.xyz

wer.defone.click

Attributes

build
250188
exe_type
loader
server_id
580

rsa_pubkey.base64

serpent.plain

Targets

- Target
  
  27d30f9286874b4fe184ffed6bd36a68.dll
- Size
  
  937KB
- MD5
  
  27d30f9286874b4fe184ffed6bd36a68
- SHA1
  
  4641f931d1bcfb33fb591d651a88fb0bb17bba93
- SHA256
  
  2765ba57873f9e68e5ca7946f24a941dd6625a3b2f489138a9eaa247cc0c2a12
- SHA512
  
  352830196009f9e6b89b333b2e5d4f62f1f60a1d156ab36c175c9218f34db426c570bc9e708e2969b236abb27921d79917641ed83c212308897f1cdb96279c1a
Score

10^/10

gozi_ifsb 4500 banker trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

gozi_ifsb4500bankertrojan

behavioral2

gozi_ifsb4500bankertrojan