General

  • Target

    image.dll

  • Size

    490KB

  • Sample

    220209-p35dfsada7

  • MD5

    08bd4c8bd321cb906c9275d0231f57b3

  • SHA1

    08f3b0f78e0c26898eca40792d499162b13a6036

  • SHA256

    00a6659355525272bce8845b6db89d2d9f89e6b96bd5379292ebfebf9cbbe68e

  • SHA512

    15023399a0df8bb361aeac6795553c19e1fe7f8f80d1386d48bfb1cd280741349e8e0eeb0cd57bf1b044e0aa5984415afff4905fff4bb2ffc369c418ed1637dd

Malware Config

Extracted

Family

gozi_ifsb

Botnet

7612

C2

securezzalink.top

securezzalink.space

linkspremium.ru

premiumlists.ru

Attributes
  • base_path

    /drew/

  • build

    250225

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Extracted

Family

gozi_ifsb

Botnet

7612

C2

premiumlines.top

premiumliner.top

premiumline.space

linespremium.ru

linespremium.pw

blogerslives.com

blogerslines.com

blogspoints.com

blogspoints.ru

filmspoints.com

Attributes
  • base_path

    /images/

  • build

    250225

  • exe_type

    worker

  • extension

    .avi

  • server_id

    50

rsa_pubkey.plain
aes.plain
rsa_pubkey.plain

Targets

    • Target

      image.dll

    • Size

      490KB

    • MD5

      08bd4c8bd321cb906c9275d0231f57b3

    • SHA1

      08f3b0f78e0c26898eca40792d499162b13a6036

    • SHA256

      00a6659355525272bce8845b6db89d2d9f89e6b96bd5379292ebfebf9cbbe68e

    • SHA512

      15023399a0df8bb361aeac6795553c19e1fe7f8f80d1386d48bfb1cd280741349e8e0eeb0cd57bf1b044e0aa5984415afff4905fff4bb2ffc369c418ed1637dd

    • Gozi, Gozi IFSB

      Gozi ISFB is a well-known and widely distributed banking trojan.

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks