Overview

overview

10

Static

static

8

af538c3dc0...a4.doc

windows7_x64

10

af538c3dc0...a4.doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    af538c3dc01f29b373d6b4b190f1e4cf447709a4.doc

  • Size

    50KB

  • Sample

    210623-fx1s71m9yx

  • MD5

    523ce06884c863bc132f5cf5efa9634e

  • SHA1

    af538c3dc01f29b373d6b4b190f1e4cf447709a4

  • SHA256

    9f4d687e8837346164d619f61e0d1354edfb080478e5bededcb652f0063af610

  • SHA512

    4353927ad417c7c414f56e1440e69a718a08805802a204a48314d910d0b8827f332aa1bfc77175b80b59c6321f518ef2749dbdaf410c34993e775f27d32b8c6e

Score
10/10
gozi_ifsb6000bankermacrotrojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

6000

C2

gtr.antoinfer.com

app.bighomegl.at
Attributes
  • build

    250204

  • exe_type

    loader

  • server_id

    580

rsa_pubkey.base64
serpent.plain

Targets

    • Target

      af538c3dc01f29b373d6b4b190f1e4cf447709a4.doc

    • Size

      50KB

    • MD5

      523ce06884c863bc132f5cf5efa9634e

    • SHA1

      af538c3dc01f29b373d6b4b190f1e4cf447709a4

    • SHA256

      9f4d687e8837346164d619f61e0d1354edfb080478e5bededcb652f0063af610

    • SHA512

      4353927ad417c7c414f56e1440e69a718a08805802a204a48314d910d0b8827f332aa1bfc77175b80b59c6321f518ef2749dbdaf410c34993e775f27d32b8c6e

    Score
    10/10
    gozi_ifsb6000bankertrojan

    • Gozi, Gozi IFSB

      Gozi ISFB is a well-known and widely distributed banking trojan.

      bankertrojangozi_ifsb

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks