gozi_ifsb | 5831ebc72dc810c036fa0c1dc85e17490ebfe2f7379b9573f99d47817b9eb42c | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
60daf82a3cb4e.dll
Size 360KB
Sample210629-svfpkrd97j
SHA256 5831ebc72dc810c036fa0c1dc85e17490ebfe2f7379b9573f99d47817b9eb42c
MD5 c33644c4f82a0c81ebc17e8c47ff2151
SHA1 592380317ff6d62338eeedf0f87b2937316c8e33
SHA512 cd0712be489241dc01b33b6f2f3cd3f34db2eddb6a282bf6a5b6e2226311a227aad3d986b9825cb5fa76266bcc3c8b2fb95f9df2650ac6b6ec55fc32b0efdac1
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 8877 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

8877

C2

outlook.com
ghjakappoppepeodkd.website
hteadclsspdkmdasd.live

Attributes

build
250206
dga_season
10
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Targets

- Target
  60daf82a3cb4e.dll
- Size 360KB
- SHA256 5831ebc72dc810c036fa0c1dc85e17490ebfe2f7379b9573f99d47817b9eb42c
- MD5 c33644c4f82a0c81ebc17e8c47ff2151
- SHA1 592380317ff6d62338eeedf0f87b2937316c8e33
- SHA512 cd0712be489241dc01b33b6f2f3cd3f34db2eddb6a282bf6a5b6e2226311a227aad3d986b9825cb5fa76266bcc3c8b2fb95f9df2650ac6b6ec55fc32b0efdac1
- MD5 SHA1 SHA512
Score

10^/10

gozi_ifsb 8877 banker trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

gozi_ifsb8877bankertrojan

behavioral2

gozi_ifsb8877bankertrojan