Extracted

Extracted

• • Target
    9342c42c91d8230ef41da6cc34df3580afedbee03706ac2d475397c21ed2feb7
  • Size 625KB
  • SHA256 9342c42c91d8230ef41da6cc34df3580afedbee03706ac2d475397c21ed2feb7
  • MD5 aa624ec2c8c3321cecab70562c9dfb79
  • SHA1 437f9fe2312d275963fde19610db509b1f581ec8
  • SHA512 31fac3ea4b142e71a605af53744debf64b7973a759f85b808c388b1dab0ee2f4e664b6394f1c5d1f22133973584c2aaa1125ad7a04ad6269e8b68c21bf415898
  • MD5 SHA1 SHA512

  Score

  10^/10

  gozi_ifsb999bankersuricatatrojan

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb

  • suricata: ET MALWARE Ursnif Payload Request (cook32.rar)

    suricata: ET MALWARE Ursnif Payload Request (cook32.rar)

    suricata

  • suricata: ET MALWARE Ursnif Payload Request (cook64.rar)

    suricata: ET MALWARE Ursnif Payload Request (cook64.rar)

    suricata

  • suricata: ET MALWARE Ursnif Variant CnC Beacon

    suricata: ET MALWARE Ursnif Variant CnC Beacon

    suricata

  • suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

    suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

    suricata

  • suricata: ET MALWARE Ursnif Variant CnC Data Exfil

    suricata: ET MALWARE Ursnif Variant CnC Data Exfil

    suricata

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Suspicious use of SetThreadContext

  behavioral1