gozi_ifsb | 67ca5cc17611a5292c116f492af8a96caebbe3539e3744daaa1f1c1a5cf72d05

Analysis

Target
9095.dll
Size 1.5MB
Sample220106-myzajabeel
SHA256 67ca5cc17611a5292c116f492af8a96caebbe3539e3744daaa1f1c1a5cf72d05
MD5 a7408cf2d8a68c9d621f04510d013c25
SHA1 06710b16a700b2f86ec7b77204b7d132a83a34f0
SHA512 04fc31d8fab45ec43490c1391e06a84e6f8e734ba6c80833351026ae9cf1420a92718875fd55b963d9b5a83b695f962fec6398991409d45f0dbc83e6f0b491d8
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Attributes

rsa_pubkey.plain

serpent.plain

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 524	3796	regsvr32.exe	69
PID 3796 wrote to memory of 524	3796	regsvr32.exe	69
PID 3796 wrote to memory of 524	3796	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9095.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9095.dll
  2⤵
  PID:524

memory/524-116-0x0000000004920000-0x0000000004921000-memory.dmp

Download

memory/524-117-0x0000000010000000-0x00000000101C4000-memory.dmp

Download