gozi_ifsb | 0570fd54d98349e62675cf1e53aa2197ed6c0df811350bfae9f64196b0a49278

Analysis

Target

960.dll
Size

942KB
MD5

96c1d2b40d981eb28aede953cf76e14a
SHA1

cbc35b375917f21ab85f989febdf8f6cb73dd7be
SHA256

0570fd54d98349e62675cf1e53aa2197ed6c0df811350bfae9f64196b0a49278
SHA512

991cf362193adb894f7b83de453174a96b21cfe4791424e6ab142c8c31b54d49dc4a8fd8698c08bd56c0f10104592647333dbf39d92dcd0c7f39edf087010244

Score

10^/10

Family

gozi_ifsb

Botnet

8899

msn.com/mail

realitystorys.com

outlook.com/signup

gderrrpololo.net

Attributes

rsa_pubkey.plain

serpent.plain

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Blocklisted process makes network request 13 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 8 wrote to memory of 3232	8	rundll32.exe	rundll32.exe
PID 8 wrote to memory of 3232	8	rundll32.exe	rundll32.exe
PID 8 wrote to memory of 3232	8	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\960.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:8

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\960.dll,#1
2⤵
- Blocklisted process makes network request
PID:3232

memory/3232-115-0x0000000000000000-mapping.dmp

Download
memory/3232-116-0x00000000741C0000-0x00000000742C4000-memory.dmp

Filesize
1.0MB

Download
memory/3232-117-0x00000000741C0000-0x00000000741CF000-memory.dmp

Filesize
60KB

Download
memory/3232-118-0x00000000741C0000-0x00000000742C4000-memory.dmp

Filesize
1.0MB

Download
memory/3232-119-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Filesize
4KB

Download