gozi_ifsb | 944ba89c2cc3696aa40b677ad61628af3c78c2dbfcc43c8ab28c6a7d0bbca74a | Triage

Sharing

General

Target

8e6e82a7810e35010a892e7b91909426.dll
Size

937KB
Sample

210624-ewk7sezrhn
MD5

8e6e82a7810e35010a892e7b91909426
SHA1

5858b70b053ddc3e5528a105d0aaee0407176a5e
SHA256

944ba89c2cc3696aa40b677ad61628af3c78c2dbfcc43c8ab28c6a7d0bbca74a
SHA512

18f8a575e1854a27a36889d2a1e282d2f3fb38e99b0a90f57b0a0c6b360fb41a3b7de378392a19646d2d1520671d858f02b51d07ae0c295624bd261cb9c68716

Score

10^/10

gozi_ifsb 4500 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

4500

C2

app3.maintorna.com

chat.billionady.com

app5.folion.xyz

wer.defone.click

Attributes

build
250188
exe_type
loader
server_id
580

rsa_pubkey.base64

serpent.plain

Targets

- Target
  
  8e6e82a7810e35010a892e7b91909426.dll
- Size
  
  937KB
- MD5
  
  8e6e82a7810e35010a892e7b91909426
- SHA1
  
  5858b70b053ddc3e5528a105d0aaee0407176a5e
- SHA256
  
  944ba89c2cc3696aa40b677ad61628af3c78c2dbfcc43c8ab28c6a7d0bbca74a
- SHA512
  
  18f8a575e1854a27a36889d2a1e282d2f3fb38e99b0a90f57b0a0c6b360fb41a3b7de378392a19646d2d1520671d858f02b51d07ae0c295624bd261cb9c68716
Score

10^/10

gozi_ifsb 4500 banker trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

gozi_ifsb4500bankertrojan

behavioral2

gozi_ifsb4500bankertrojan