Extracted

• • Target
    http://ntv-play.com/video/04169823/tls/console-play.exe

  Score

  10^/10

  gozi_ifsb1001bankerdiscoverypersistencespywarestealersuricatatrojan

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • suricata: ET MALWARE Ursnif Variant CnC Beacon

    suricata: ET MALWARE Ursnif Variant CnC Beacon

    suricata

  • suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)

    suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)

    suricata

  • suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

    suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

    suricata

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1