Overview

overview

10

Static

static

616e88722e192.rar.dll

windows7_x64

10

616e88722e192.rar.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    616e88722e192.rar.dll

  • Size

    606KB

  • Sample

    211019-k1x45sfea8

  • MD5

    17829c58f1700bde92c95cc972471b57

  • SHA1

    1f1565c7f220a8155b37be06e75fdbc7c1f74e60

  • SHA256

    88923375a9855f6fc99382ad1733c340feee666cb0b6930c656875f1cdeb922b

  • SHA512

    87af2af38d1a5747a44021e09ffffc9d17ab8e2c53bf4608e2aed06942efde7c792346963f26bccf5113d159570b067c91ab58af64f375684633633ec4b31410

Score
10/10
gozi_ifsb5566bankertrojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

5566

C2

outlook.com

peajame.com

gderrrpololo.net
Attributes
  • build

    250211

  • dga_season

    10

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      616e88722e192.rar.dll

    • Size

      606KB

    • MD5

      17829c58f1700bde92c95cc972471b57

    • SHA1

      1f1565c7f220a8155b37be06e75fdbc7c1f74e60

    • SHA256

      88923375a9855f6fc99382ad1733c340feee666cb0b6930c656875f1cdeb922b

    • SHA512

      87af2af38d1a5747a44021e09ffffc9d17ab8e2c53bf4608e2aed06942efde7c792346963f26bccf5113d159570b067c91ab58af64f375684633633ec4b31410

    Score
    10/10
    gozi_ifsb5566bankertrojan

    • Gozi, Gozi IFSB

      Gozi ISFB is a well-known and widely distributed banking trojan.

      bankertrojangozi_ifsb

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks