Overview

overview

10

Static

static

716ce7fe41...25.exe

windows7_x64

10

716ce7fe41...25.exe

windows10-2004_x64

10

Resubmissions

19-01-2022 16:33

220119-t2qk5abeck 10

25-11-2021 12:40

211125-pv9m7sfbhq 8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25

  • Size

    7.5MB

  • Sample

    220119-t2qk5abeck

  • MD5

    4ec77eb8280485764b6bc22f6cf7d57e

  • SHA1

    85215638743eeb6800aaada5d057e96032db6906

  • SHA256

    716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25

  • SHA512

    770b14b133ac0a7bfee3a973d43a5342cd021a731f1be4d557a332aa4945dbb9be6b25909291feeb766c3fd640ff943780d4172e2fe6f6c77a128585e7914954

Score
10/10
babadedagozi_ifsb2002bankercrypterloadertrojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

2002

C2

get.updates.avast.cn

huyasos.in

curves.ws

rorobrun.in

tfslld.ws
Attributes
  • base_path

    /sreamble/

  • build

    250211

  • dga_season

    10

  • exe_type

    loader

  • extension

    .sre

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25

    • Size

      7.5MB

    • MD5

      4ec77eb8280485764b6bc22f6cf7d57e

    • SHA1

      85215638743eeb6800aaada5d057e96032db6906

    • SHA256

      716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25

    • SHA512

      770b14b133ac0a7bfee3a973d43a5342cd021a731f1be4d557a332aa4945dbb9be6b25909291feeb766c3fd640ff943780d4172e2fe6f6c77a128585e7914954

    Score
    10/10
    babadedagozi_ifsb2002bankercrypterloadertrojan

    • Babadeda

      Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.

      loadercrypterbabadeda

    • Babadeda Crypter

    • Gozi, Gozi IFSB

      Gozi ISFB is a well-known and widely distributed banking trojan.

      bankertrojangozi_ifsb

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks