Overview

overview

10

Static

static

383f57d966...80.dll

windows7_x64

10

383f57d966...80.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    383f57d9665b8533771ea9d033d16080.dll

  • Size

    467KB

  • Sample

    211026-rez5yahfd9

  • MD5

    383f57d9665b8533771ea9d033d16080

  • SHA1

    a544d243cd894f6b320df866c8d1de2da7cbb57e

  • SHA256

    9489b404fde84f919122108ec0b56fd7376dbbc706a5733aa5e2dc3aeb005034

  • SHA512

    056d257d11e2c1b6b8b2b7e6a3554bbf72d18197a962771cc03068299d4f349893ca4ff289e92e66031f477572519faad7b82e886ee433f6ea859a9689e07f63

Score
10/10
gozi_ifsb8899bankertrojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

8899

C2

msn.com/mail

realitystorys.com

outlook.com/signup

gderrrpololo.net
Attributes
  • build

    260212

  • dga_season

    10

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      383f57d9665b8533771ea9d033d16080.dll

    • Size

      467KB

    • MD5

      383f57d9665b8533771ea9d033d16080

    • SHA1

      a544d243cd894f6b320df866c8d1de2da7cbb57e

    • SHA256

      9489b404fde84f919122108ec0b56fd7376dbbc706a5733aa5e2dc3aeb005034

    • SHA512

      056d257d11e2c1b6b8b2b7e6a3554bbf72d18197a962771cc03068299d4f349893ca4ff289e92e66031f477572519faad7b82e886ee433f6ea859a9689e07f63

    Score
    10/10
    gozi_ifsb8899bankertrojan

    • Gozi, Gozi IFSB

      Gozi ISFB is a well-known and widely distributed banking trojan.

      bankertrojangozi_ifsb

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks