Extracted

Extracted

• • Target
    0x0007000000012676-63.exe
  • Size 406KB
  • SHA256 bd9eb71baa0d28bff80cbfa742346aa8f6d08ac463ce85bd97b9842aa6a2bbcb
  • MD5 136837b24eb33a39fbb5d1b62ab167a5
  • SHA1 cff7636028417b342903905cfa0d9e549f7f8e63
  • SHA512 818fc3fe7f396d1d192b8ef7c63df3fd74ad6b08ceffe5077dec9e819b78eb52531079601ce92d510963a8e2acadfc6f2525caacca774e13d2a6470b3c6427b8
  • MD5 SHA1 SHA512

  Score

  10^/10

  gozi_ifsb555bankertrojansuricata

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb

  • suricata: ET MALWARE Ursnif Payload Request (cook32.rar)

    suricata: ET MALWARE Ursnif Payload Request (cook32.rar)

    suricata

  • suricata: ET MALWARE Ursnif Payload Request (cook64.rar)

    suricata: ET MALWARE Ursnif Payload Request (cook64.rar)

    suricata

  • suricata: ET MALWARE Ursnif Variant CnC Beacon

    suricata: ET MALWARE Ursnif Variant CnC Beacon

    suricata

  • suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

    suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

    suricata

  • suricata: ET MALWARE Ursnif Variant CnC Data Exfil

    suricata: ET MALWARE Ursnif Variant CnC Data Exfil

    suricata

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2