gozi_ifsb | 1acf812c3d5c32bca270988941edd32e5367aef6f972ce7a7b37d3b0ff2a771f | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
1acf812c3d5c32bca270988941edd32e5367aef6f972ce7a7b37d3b0ff2a771f
Size 624KB
Sample220422-tb97vaaabn
SHA256 1acf812c3d5c32bca270988941edd32e5367aef6f972ce7a7b37d3b0ff2a771f
MD5 3cb14af0b3ff172af4a030a3bc09ae9b
SHA1 045aa620e8b3307c8bba11d5a666d67ecc871b5f
SHA512 5341620e32d8ca75d73cd56c1b06b16c05c3a6f7d06d867d07f98270d48d6c867e6994024371c3d3e8c539a571cf0d2b1280f78201cacb8deb0ce648c9b2ca74
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 999 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

999

C2

config.edge.skype.com
146.70.35.138
146.70.35.142

Attributes

base_path
/phpadmin/
build
250227
exe_type
loader
extension
.src
server_id
50

rsa_pubkey.plain

aes.plain

Targets

- Target
  1acf812c3d5c32bca270988941edd32e5367aef6f972ce7a7b37d3b0ff2a771f
- Size 624KB
- SHA256 1acf812c3d5c32bca270988941edd32e5367aef6f972ce7a7b37d3b0ff2a771f
- MD5 3cb14af0b3ff172af4a030a3bc09ae9b
- SHA1 045aa620e8b3307c8bba11d5a666d67ecc871b5f
- SHA512 5341620e32d8ca75d73cd56c1b06b16c05c3a6f7d06d867d07f98270d48d6c867e6994024371c3d3e8c539a571cf0d2b1280f78201cacb8deb0ce648c9b2ca74
- MD5 SHA1 SHA512
Score

10^/10

gozi_ifsb 999 banker trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

gozi_ifsb999bankertrojan