gozi_ifsb | 154fcf6de1a4d2148da99d796d7c611b10d894546610561b588a970ab7c7053f | Triage

Analysis

max time kernel
17s
max time network
18s
platform
windows10_x64
resource
win10-en-20210920
submitted
21-10-2021 09:38

Sharing

Report Analysis Logs

General

Target

5e7740afdd5c5865a2304e2f7c5fc3f1cd1016f503a4b1752923f44059fd1a57.exe
Size

208KB
MD5

35e3868c7d28d2ed87248077f670c707
SHA1

8e54a89fc59683cee86de964ec475dea9fc5618b
SHA256

5e7740afdd5c5865a2304e2f7c5fc3f1cd1016f503a4b1752923f44059fd1a57
SHA512

c8bbf7d192aff6c45005700014a22ea72832febc73b16ae925b339a356815b27bea3252917a9aa94e48fc05377b85bd1206f33c7e46fb17bdf325aff7ef40e37

Score

10^/10

gozi_ifsb 3400 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Attributes

build
214082

Extracted

Family

gozi_ifsb

Botnet

3400

C2

microsoft.com

update.microsoft.com

avast.com

tm90daron.club

jamericohermann.com

b9437ariane.com

Attributes

build
214082
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

C:\Users\Admin\AppData\Local\Temp\5e7740afdd5c5865a2304e2f7c5fc3f1cd1016f503a4b1752923f44059fd1a57.exe
"C:\Users\Admin\AppData\Local\Temp\5e7740afdd5c5865a2304e2f7c5fc3f1cd1016f503a4b1752923f44059fd1a57.exe"
1⤵
PID:4068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4068-115-0x0000000000A40000-0x0000000000A4E000-memory.dmp

Filesize
56KB

Download
memory/4068-116-0x0000000000A40000-0x0000000000A88000-memory.dmp

Filesize
288KB

Download
memory/4068-118-0x0000000000EE0000-0x0000000000EEF000-memory.dmp

Filesize
60KB

Download
memory/4068-120-0x0000000000ED0000-0x0000000000EF3000-memory.dmp

Filesize
140KB

Download