gozi_ifsb | fd11e035295639b19dfe418514c91159b3f50ea8dc350c36b63a9363e52f4533 | Triage

Analysis

max time kernel
117s
max time network
137s
platform
windows7_x64
resource
win7-en-20210920
submitted
21-10-2021 18:52

Sharing

Report Analysis Logs

General

Target

fd11e035295639b19dfe418514c91159b3f50ea8dc350c36b63a9363e52f4533.exe
Size

468KB
MD5

87aee37bf3a439092a819a1f3bb189e8
SHA1

d1d24a16f7dde7dfe78800e9dd82ff9f39d58dcf
SHA256

fd11e035295639b19dfe418514c91159b3f50ea8dc350c36b63a9363e52f4533
SHA512

3dfdaef3d7e6ec5fbc11917d5a09ea7492ac95692b976c695ac3adb074fe1705d9cc3bcfcfccdaf42335751f52ec3d1c41a190977e7463dcc2b0eb32d73376fe

Score

10^/10

gozi_ifsb banker trojan

Malware Config

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
Suspicious use of UnmapMainImage 1 IoCs

Processes:

fd11e035295639b19dfe418514c91159b3f50ea8dc350c36b63a9363e52f4533.exe

pid process

1852 fd11e035295639b19dfe418514c91159b3f50ea8dc350c36b63a9363e52f4533.exe

C:\Users\Admin\AppData\Local\Temp\fd11e035295639b19dfe418514c91159b3f50ea8dc350c36b63a9363e52f4533.exe
"C:\Users\Admin\AppData\Local\Temp\fd11e035295639b19dfe418514c91159b3f50ea8dc350c36b63a9363e52f4533.exe"
1⤵
- Suspicious use of UnmapMainImage
PID:1852

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1852-54-0x0000000076B61000-0x0000000076B63000-memory.dmp

Filesize
8KB

Download
memory/1852-56-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1852-55-0x0000000000280000-0x00000000002C2000-memory.dmp

Filesize
264KB

Download