gozi_ifsb | 16fbdf2f5ccc8e8d788a47da9e676a99f619ebdbdafab8ad388850372898e276 | Triage

Resubmissions

01-07-2021 03:02

210701-m1tgeqjnvn 10

28-05-2021 05:35

210528-qpvtvlrjka 10

Sharing

General

Target

16fbdf2f5ccc8e8d788a47da9e676a99f619ebdbdafab8ad388850372898e276.dll
Size

937KB
Sample

210701-m1tgeqjnvn
MD5

6fa76bfd8289de74e645dbb570261c13
SHA1

47792f10a28158920fb7c646c78d06e138345e52
SHA256

16fbdf2f5ccc8e8d788a47da9e676a99f619ebdbdafab8ad388850372898e276
SHA512

e7b9c02861b1ae2a7a46b6dd85db570fd7c8df44113d74ecd14f7cea47f9d43fde725557ce1973c861b4d4fd84e2e8c2bdcfbb5d623ff067ed5154e7ece30765

Score

10^/10

gozi_ifsb 4500 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

4500

C2

app3.maintorna.com

chat.billionady.com

app5.folion.xyz

wer.defone.click

Attributes

build
250188
exe_type
loader
server_id
580

rsa_pubkey.plain

aes.plain

Targets

- Target
  
  16fbdf2f5ccc8e8d788a47da9e676a99f619ebdbdafab8ad388850372898e276.dll
- Size
  
  937KB
- MD5
  
  6fa76bfd8289de74e645dbb570261c13
- SHA1
  
  47792f10a28158920fb7c646c78d06e138345e52
- SHA256
  
  16fbdf2f5ccc8e8d788a47da9e676a99f619ebdbdafab8ad388850372898e276
- SHA512
  
  e7b9c02861b1ae2a7a46b6dd85db570fd7c8df44113d74ecd14f7cea47f9d43fde725557ce1973c861b4d4fd84e2e8c2bdcfbb5d623ff067ed5154e7ece30765
Score

10^/10

gozi_ifsb 4500 banker trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

gozi_ifsb4500bankertrojan

behavioral2

gozi_ifsb4500bankertrojan