gozi_ifsb | 907db4913759546d4f1cc76c09e6e60fef059938ace8ccc6eab66c17b2627bb0 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
907db4913759546d4f1cc76c09e6e60fef059938ace8ccc6eab66c17b2627bb0
Size 625KB
Sample220422-s186eahhbp
SHA256 907db4913759546d4f1cc76c09e6e60fef059938ace8ccc6eab66c17b2627bb0
MD5 84086647c61fd293c91ad3cf6e07aa3b
SHA1 b0ea9ede4e571c9d8a531cecdbba7b7a50626bb2
SHA512 fd150fe6ed6731fb81b40f8349deaa9e20f92b407a58a24f78b424a956328bb6680b45c9d6d2900d459f4801596db2638bf7a5c2bf887002dbae0d7a9b2e9b48
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 999 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

999

C2

config.edge.skype.com
146.70.35.138
146.70.35.142

Attributes

base_path
/phpadmin/
build
250227
exe_type
loader
extension
.src
server_id
50

rsa_pubkey.plain

aes.plain

Targets

- Target
  907db4913759546d4f1cc76c09e6e60fef059938ace8ccc6eab66c17b2627bb0
- Size 625KB
- SHA256 907db4913759546d4f1cc76c09e6e60fef059938ace8ccc6eab66c17b2627bb0
- MD5 84086647c61fd293c91ad3cf6e07aa3b
- SHA1 b0ea9ede4e571c9d8a531cecdbba7b7a50626bb2
- SHA512 fd150fe6ed6731fb81b40f8349deaa9e20f92b407a58a24f78b424a956328bb6680b45c9d6d2900d459f4801596db2638bf7a5c2bf887002dbae0d7a9b2e9b48
- MD5 SHA1 SHA512
Score

10^/10

gozi_ifsb 999 banker trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

gozi_ifsb999bankertrojan