gozi_ifsb | c21498aea57a809c36258572bc551c6047a4bf93958bc7a3d4b46d844fc9f1b3

Target

3d0.dll
Size

492KB
MD5

3d080af5324b49363773d0db21b620ed
SHA1

2724f486e0f8607eda3ea9e9783ea4f46bc98342
SHA256

c21498aea57a809c36258572bc551c6047a4bf93958bc7a3d4b46d844fc9f1b3
SHA512

d68d25125dc209f16936b8baad4334f7bb6c4fa58207fafd5428cb1c98630d668da6253e010ac4bb4dedd1dd418f1f31e08acef689e5f663fbde28c7935fadc0

Score

10^/10

Malware Config

Family

gozi_ifsb

Botnet

6000

authd.feronok.com

app.bighomegl.at

Attributes

rsa_pubkey.plain

aes.plain

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Ursnif/Gozi Banker 1 IoCs

Detects the unpacked DLL of Ursnif/Gozi Banking Trojan.

Processes:

resource	yara_rule
behavioral1/memory/2036-63-0x0000000000310000-0x000000000031D000-memory.dmp	banker_ursnif

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1908 wrote to memory of 2036	1908	rundll32.exe	rundll32.exe
PID 1908 wrote to memory of 2036	1908	rundll32.exe	rundll32.exe
PID 1908 wrote to memory of 2036	1908	rundll32.exe	rundll32.exe
PID 1908 wrote to memory of 2036	1908	rundll32.exe	rundll32.exe
PID 1908 wrote to memory of 2036	1908	rundll32.exe	rundll32.exe
PID 1908 wrote to memory of 2036	1908	rundll32.exe	rundll32.exe
PID 1908 wrote to memory of 2036	1908	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1908

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d0.dll,#1
2⤵
PID:2036

memory/2036-60-0x0000000000000000-mapping.dmp

Download
memory/2036-61-0x0000000075B31000-0x0000000075B33000-memory.dmp

Filesize
8KB

Download
memory/2036-62-0x0000000000310000-0x00000000003A0000-memory.dmp

Filesize
576KB

Download
memory/2036-63-0x0000000000310000-0x000000000031D000-memory.dmp

Filesize
52KB

Download
memory/2036-64-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download