gozi_ifsb | 4e7f81fa970f3c2ffa70c22d10b2c81efbf7429594719be49b56a0b516503e4b

Analysis

Target

7dc420886e9c1a1e40e34d73ed2faf7c.dll
Size

139KB
MD5

7dc420886e9c1a1e40e34d73ed2faf7c
SHA1

1cf57d47fab52815150a8236e985e7976aba4f75
SHA256

4e7f81fa970f3c2ffa70c22d10b2c81efbf7429594719be49b56a0b516503e4b
SHA512

71ed19f4556c8b87b8a5c9d833404aa1cb531bdabfbd5527760fbe1530d24db8c2eab71c03b1d351878789cb06bdf34e0a95f9b829b2354b9c1a6514a8028b5d

Score

10^/10

Family

gozi_ifsb

Botnet

8899

microsoft.com/windowsdisabler

https://technoshoper.com

https://avolebukoneh.website

http://technoshoper.com

http://avolebukoneh.website

Attributes

rsa_pubkey.plain

serpent.plain

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
suricata
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
suricata

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2800 wrote to memory of 2804	2800	regsvr32.exe	regsvr32.exe
PID 2800 wrote to memory of 2804	2800	regsvr32.exe	regsvr32.exe
PID 2800 wrote to memory of 2804	2800	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7dc420886e9c1a1e40e34d73ed2faf7c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2800

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\7dc420886e9c1a1e40e34d73ed2faf7c.dll
2⤵
PID:2804

memory/2804-115-0x0000000000000000-mapping.dmp

Download
memory/2804-116-0x0000000004680000-0x000000000468F000-memory.dmp

Filesize
60KB

Download