gozi_ifsb | 4edfb1b3a28524cdf10d2e10ba4e6411013607949359987c07d3d715bfca3cce | Triage

Sharing

General

Target

4edfb1b3a28524cdf10d2e10ba4e6411013607949359987c07d3d715bfca3cce
Size

497KB
Sample

211025-z7vd6agfe6
MD5

11e1bb1bb27820c92a7c4a4c1a356184
SHA1

99755d73681d052d3391c9f2b90030272faa640f
SHA256

4edfb1b3a28524cdf10d2e10ba4e6411013607949359987c07d3d715bfca3cce
SHA512

52effae2a754dcd59501620f3567bf3f4ed4e2faad02d15dbf53483710e2504be572b35f5cce74a1923df6f77641acfd612cc99e829d27787b5827c4b14063c8

Score

10^/10

gozi_ifsb 1500 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

1500

C2

apt.updateffboruse.com

app.updatebrouser.com

Attributes

build
250211
exe_type
loader
server_id
580

rsa_pubkey.plain

aes.plain

Targets

- Target
  
  4edfb1b3a28524cdf10d2e10ba4e6411013607949359987c07d3d715bfca3cce
- Size
  
  497KB
- MD5
  
  11e1bb1bb27820c92a7c4a4c1a356184
- SHA1
  
  99755d73681d052d3391c9f2b90030272faa640f
- SHA256
  
  4edfb1b3a28524cdf10d2e10ba4e6411013607949359987c07d3d715bfca3cce
- SHA512
  
  52effae2a754dcd59501620f3567bf3f4ed4e2faad02d15dbf53483710e2504be572b35f5cce74a1923df6f77641acfd612cc99e829d27787b5827c4b14063c8
Score

10^/10

gozi_ifsb 1500 banker trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

gozi_ifsb1500bankertrojan

behavioral2

gozi_ifsb1500bankertrojan