Extracted

Extracted

• • Target
    9095.exe
  • Size 152KB
  • SHA256 d4e5ea6e804aee0817c61b11e1ed009f649ff37d30bafa7056bf82d45e83f44d
  • MD5 57054d13b876e70a99b6b9510568ed3e
  • SHA1 1fe09821917e0d6d07b233e7264bdc235dc2f52b
  • SHA512 f73c8d9063dac80871c99343f9b8586f77ca64ea9aa0ca5f14078f7e56d9c24f52577d6ae6f04dfecc1ad580395bfb2e789eb8ee4ca8059b3022048a77137257
  • MD5 SHA1 SHA512

  Score

  10^/10

  persistencegozi_ifsb9095bankersuricatatrojan

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb

  • suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)

    suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)

    suricata

  • suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

    suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2