gozi_ifsb | 54ce5aedb7cc073c481eb8af96f89f3ab11e5decaccf942d033479fd0f04c8b3 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
60ed4ca406c9c.dll
Size 464KB
Sample210713-levy8ccgre
SHA256 54ce5aedb7cc073c481eb8af96f89f3ab11e5decaccf942d033479fd0f04c8b3
MD5 0b0f6ef1bb8553c3c47e9330781c0d03
SHA1 c782b922dcc92b24dfd80f98d96b61df64f79f18
SHA512 32a37baa9f5513f457adb28abfbdebc8d74e171dc0374f155e14ddaac2657fba5645345e5bb4ee188bf70d8a5d5d55a3bb50d61658d933a95e6b944ab41322f6
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 8877 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

8877

C2

outlook.com
dronmakerparallel.email
moonlightparallels.email

Attributes

build
250207
dga_season
10
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Targets

- Target
  60ed4ca406c9c.dll
- Size 464KB
- SHA256 54ce5aedb7cc073c481eb8af96f89f3ab11e5decaccf942d033479fd0f04c8b3
- MD5 0b0f6ef1bb8553c3c47e9330781c0d03
- SHA1 c782b922dcc92b24dfd80f98d96b61df64f79f18
- SHA512 32a37baa9f5513f457adb28abfbdebc8d74e171dc0374f155e14ddaac2657fba5645345e5bb4ee188bf70d8a5d5d55a3bb50d61658d933a95e6b944ab41322f6
- MD5 SHA1 SHA512
Score

10^/10

gozi_ifsb 8877 banker trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

gozi_ifsb8877bankertrojan

behavioral2

gozi_ifsb8877bankertrojan