gozi_ifsb | 0a3bc15ceb80f700d80b7d651ff378cf407c239f3e513e3bc9bd854f82f7e22c | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
61238cfcc2441.dll
Size 544KB
Sample210823-2mk5ahabbn
SHA256 0a3bc15ceb80f700d80b7d651ff378cf407c239f3e513e3bc9bd854f82f7e22c
MD5 454908e620c33ca3e631a6334e8b1ff1
SHA1 50f292391060ff4d772a4fd695f9eba8432a8fd8
SHA512 0e3165221a8f751c2e54e40d5ffa2012b43535f19bf89a0d6b7f7ec287546e1312c6c43759bd2cc97ad4bc0e9fcc622dbc42b5c7a7f17f2794f1101607de6ca7
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 8877 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

8877

C2

outlook.com
xaaorunokee.site
taaorunokee.site

Attributes

build
250212
dga_season
10
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Targets

- Target
  61238cfcc2441.dll
- Size 544KB
- SHA256 0a3bc15ceb80f700d80b7d651ff378cf407c239f3e513e3bc9bd854f82f7e22c
- MD5 454908e620c33ca3e631a6334e8b1ff1
- SHA1 50f292391060ff4d772a4fd695f9eba8432a8fd8
- SHA512 0e3165221a8f751c2e54e40d5ffa2012b43535f19bf89a0d6b7f7ec287546e1312c6c43759bd2cc97ad4bc0e9fcc622dbc42b5c7a7f17f2794f1101607de6ca7
- MD5 SHA1 SHA512
Score

10^/10

gozi_ifsb 8877 banker trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

gozi_ifsb8877bankertrojan

behavioral2