gozi_ifsb | de6401671345604ac86f9113fb5c748409ab16b17f0a10f9a96e18fdfe6bb81d | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
de6401671345604ac86f9113fb5c748409ab16b17f0a10f9a96e18fdfe6bb81d
Size 624KB
Sample220422-s3mp7addf3
SHA256 de6401671345604ac86f9113fb5c748409ab16b17f0a10f9a96e18fdfe6bb81d
MD5 8481da3a00989991d8f2abb32fa183a6
SHA1 6aab7d9fc30130a9427272f0d3d0a21d2674add1
SHA512 f8cdffc367d0a8342a9a0bec0a6273626924e09d3485b8bfd392129d6cc31d59f33f5ef00d4989b7a545df85305dcf279c4dda14f4dd416e4073b44719b7b713
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 999 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

999

C2

config.edge.skype.com
146.70.35.138
146.70.35.142

Attributes

base_path
/phpadmin/
build
250227
exe_type
loader
extension
.src
server_id
50

rsa_pubkey.plain

aes.plain

Targets

- Target
  de6401671345604ac86f9113fb5c748409ab16b17f0a10f9a96e18fdfe6bb81d
- Size 624KB
- SHA256 de6401671345604ac86f9113fb5c748409ab16b17f0a10f9a96e18fdfe6bb81d
- MD5 8481da3a00989991d8f2abb32fa183a6
- SHA1 6aab7d9fc30130a9427272f0d3d0a21d2674add1
- SHA512 f8cdffc367d0a8342a9a0bec0a6273626924e09d3485b8bfd392129d6cc31d59f33f5ef00d4989b7a545df85305dcf279c4dda14f4dd416e4073b44719b7b713
- MD5 SHA1 SHA512
Score

10^/10

gozi_ifsb 999 banker trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

gozi_ifsb999bankertrojan