Overview

overview

10

Static

static

6.bin.dll

windows7_x64

10

6.bin.dll

windows10_x64

10

Resubmissions

09/12/2021, 17:58

211209-wj5nfaeedr10

22/11/2021, 16:33

211122-t2z5kagadm3

Sharing

Copy URL Twitter E-mail

General

  • Target
    6.bin
  • Size 119KB
  • Sample211209-wj5nfaeedr
  • SHA256 b82a1d06e5650808ae0b9ef1a77cc6047ca0601b13a9afa8cded17a93e27cda9
  • MD5 SHA1 SHA512
Score
10/10
gozi_ifsb8899bankersuricatatrojan

Malware Config

Extracted

Family

  • gozi_ifsb

Botnet

  • 8899

C2

  • microsoft.com/windowsdisabler

  • https://technoshoper.com

  • https://avolebukoneh.website

  • http://technoshoper.com

  • http://avolebukoneh.website

Attributes
  • base_path

    /glik/

  • build

    260216

  • dga_season

    10

  • exe_type

    loader

  • extension

    .lwe

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target
      6.bin
    • Size 119KB
    • SHA256 b82a1d06e5650808ae0b9ef1a77cc6047ca0601b13a9afa8cded17a93e27cda9
    • MD5 SHA1 SHA512
    Score
    10/10
    gozi_ifsb8899bankertrojansuricata

    • Gozi, Gozi IFSB

      Gozi ISFB is a well-known and widely distributed banking trojan.

      bankertrojangozi_ifsb

    • suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)

      suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)

      suricata

    • suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

      suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

      suricata
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks