gozi_ifsb | 42eac4473d3da23a10f9509b8758c6bab2f7bd31a572f4837e7214594ed98af9 | Triage

Sharing

General

Target

42eac4473d3da23a10f9509b8758c6bab2f7bd31a572f4837e7214594ed98af9
Size

350KB
Sample

211025-1fjn1sgfg5
MD5

23e292c05d33fecac68beb941399608c
SHA1

1711489c5d9995c080f04db3c8ee26aa0509eded
SHA256

42eac4473d3da23a10f9509b8758c6bab2f7bd31a572f4837e7214594ed98af9
SHA512

4e8784a8d8df976d41fbd747f496d0c09fd4853f55ba0fe7590ab394caebe8b02acb0225e2f3e3ea2364c053556ab87a0f2d20f77a69678127ab9f5bfbf7dff5

Score

10^/10

gozi_ifsb 2500 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

2500

C2

apt.updateffboruse.com

app.updatebrouser.com

Attributes

build
250211
exe_type
loader
server_id
580

rsa_pubkey.plain

aes.plain

Targets

- Target
  
  42eac4473d3da23a10f9509b8758c6bab2f7bd31a572f4837e7214594ed98af9
- Size
  
  350KB
- MD5
  
  23e292c05d33fecac68beb941399608c
- SHA1
  
  1711489c5d9995c080f04db3c8ee26aa0509eded
- SHA256
  
  42eac4473d3da23a10f9509b8758c6bab2f7bd31a572f4837e7214594ed98af9
- SHA512
  
  4e8784a8d8df976d41fbd747f496d0c09fd4853f55ba0fe7590ab394caebe8b02acb0225e2f3e3ea2364c053556ab87a0f2d20f77a69678127ab9f5bfbf7dff5
Score

10^/10

gozi_ifsb 2500 banker trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

gozi_ifsb2500bankertrojan

behavioral2

gozi_ifsb2500bankertrojan