Overview

overview

10

Static

static

b938df3257...80.dll

windows7_x64

10

b938df3257...80.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b938df3257c4c0f916955b0a689dd280.dll

  • Size

    942KB

  • Sample

    211026-ydcftaabg7

  • MD5

    b938df3257c4c0f916955b0a689dd280

  • SHA1

    8058abf1aa17283ab8c6fe65e303011f46cda884

  • SHA256

    79ab62103a0d4eb9fe40aa94aa9d2f2f669c1bcf29119930ede17bb4cd1a9d6c

  • SHA512

    80df5775165e17d44374bd8e794ff690ecf5c4ab087977df58d476a180dfdc9babe35e124cac2957448aa2b6904aaf6a297af9584541c438c4a9d582c0f77897

Score
10/10
gozi_ifsb8899bankertrojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

8899

C2

msn.com/mail

realitystorys.com

outlook.com/signup

gderrrpololo.net
Attributes
  • build

    260212

  • dga_season

    10

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      b938df3257c4c0f916955b0a689dd280.dll

    • Size

      942KB

    • MD5

      b938df3257c4c0f916955b0a689dd280

    • SHA1

      8058abf1aa17283ab8c6fe65e303011f46cda884

    • SHA256

      79ab62103a0d4eb9fe40aa94aa9d2f2f669c1bcf29119930ede17bb4cd1a9d6c

    • SHA512

      80df5775165e17d44374bd8e794ff690ecf5c4ab087977df58d476a180dfdc9babe35e124cac2957448aa2b6904aaf6a297af9584541c438c4a9d582c0f77897

    Score
    10/10
    gozi_ifsb8899bankertrojan

    • Gozi, Gozi IFSB

      Gozi ISFB is a well-known and widely distributed banking trojan.

      bankertrojangozi_ifsb

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks