Overview

overview

10

Static

static

716ce7fe41...25.exe

windows7_x64

10

716ce7fe41...25.exe

windows10-2004_x64

10

Resubmissions

19/01/2022, 16:33

220119-t2qk5abeck10

25/11/2021, 12:40

211125-pv9m7sfbhq8

Sharing

Copy URL Twitter E-mail

General

  • Target
    716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25
  • Size 7.5MB
  • Sample220119-t2qk5abeck
  • SHA256 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25
  • MD5 SHA1 SHA512
Score
10/10
babadedagozi_ifsb2002bankercrypterloadertrojan

Malware Config

Extracted

Family

  • gozi_ifsb

Botnet

  • 2002

C2

  • get.updates.avast.cn

  • huyasos.in

  • curves.ws

  • rorobrun.in

  • tfslld.ws

Attributes
  • base_path

    /sreamble/

  • build

    250211

  • dga_season

    10

  • exe_type

    loader

  • extension

    .sre

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target
      716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25
    • Size 7.5MB
    • SHA256 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25
    • MD5 SHA1 SHA512
    Score
    10/10
    babadedagozi_ifsb2002bankercrypterloadertrojan

    • Babadeda

      Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.

      loadercrypterbabadeda

    • Babadeda Crypter

    • Gozi, Gozi IFSB

      Gozi ISFB is a well-known and widely distributed banking trojan.

      bankertrojangozi_ifsb

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks