Overview

overview

10

Static

static

10

09a9043681...b9.dll

windows7_x64

3

09a9043681...b9.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    09a9043681c5eb5e79e974a51f0f03edb4b09db7a916c146a97fb501896350b9

  • Size

    52KB

  • Sample

    220201-m3erpadga8

  • MD5

    7159b4111de1095b1c0bb07e201e43c1

  • SHA1

    1240614f5241e1383320900382695e8d211f3383

  • SHA256

    09a9043681c5eb5e79e974a51f0f03edb4b09db7a916c146a97fb501896350b9

  • SHA512

    39f73611213b118bcd52d385bd94324ec6b66dc5d711ef4c52fc865cf3cf0f946400a04368e506d0edd2a1e4749312b0cf745783df93ceb3f032cf65d8504341

Score
10/10
gozi_ifsb1500persistence

Malware Config

Extracted

Family

gozi_ifsb

Botnet

1500

C2

gtr.antoinfer.com

app.bighomegl.at
Attributes
  • build

    250211

  • exe_type

    loader

  • server_id

    580

rsa_pubkey.plain
aes.plain

Targets

    • Target

      09a9043681c5eb5e79e974a51f0f03edb4b09db7a916c146a97fb501896350b9

    • Size

      52KB

    • MD5

      7159b4111de1095b1c0bb07e201e43c1

    • SHA1

      1240614f5241e1383320900382695e8d211f3383

    • SHA256

      09a9043681c5eb5e79e974a51f0f03edb4b09db7a916c146a97fb501896350b9

    • SHA512

      39f73611213b118bcd52d385bd94324ec6b66dc5d711ef4c52fc865cf3cf0f946400a04368e506d0edd2a1e4749312b0cf745783df93ceb3f032cf65d8504341

    Score
    10/10
    persistence

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Sets service image path in registry

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks