Extracted

Extracted

• • Target
    624c9238527dd.dll
  • Size 524KB
  • SHA256 53c98ffe8239d1b715de36fb51e0dfd87ffa02d11a2e9d5df3c010e9d6973354
  • MD5 8566d619e8c0a0138166c1ab7eaee50c
  • SHA1 a0919456f1e540388a46566efd431a9708e20f4a
  • SHA512 78279ff36e589e270c43cd44eeb22c3debb3c54f7f440cdc4995dd0bbec2b9d665f638b7a54fa625937a2f86b13dbd4d7e22336d22d0b381af5a81d57eeec069
  • MD5 SHA1 SHA512

  Score

  10^/10

  gozi_ifsb3000bankersuricatatrojan

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb

  • suricata: ET MALWARE Generic .bin download from Dotted Quad

    suricata: ET MALWARE Generic .bin download from Dotted Quad

    suricata

  • suricata: ET MALWARE Ursnif Payload Request (cook32.rar)

    suricata: ET MALWARE Ursnif Payload Request (cook32.rar)

    suricata

  • suricata: ET MALWARE Ursnif Payload Request (cook64.rar)

    suricata: ET MALWARE Ursnif Payload Request (cook64.rar)

    suricata

  • suricata: ET MALWARE Ursnif Variant CnC Beacon

    suricata: ET MALWARE Ursnif Variant CnC Beacon

    suricata

  • suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

    suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

    suricata

  • suricata: ET MALWARE Ursnif Variant CnC Data Exfil

    suricata: ET MALWARE Ursnif Variant CnC Data Exfil

    suricata

  • suricata: ET MALWARE Zbot Generic URI/Header Struct .bin

    suricata: ET MALWARE Zbot Generic URI/Header Struct .bin

    suricata

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2