gozi_ifsb | 53839806f71da6c6fb1d6c27c34f3a0fc2fca1a651bae5e631d9958376110f85 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
53839806f71da6c6fb1d6c27c34f3a0fc2fca1a651bae5e631d9958376110f85
Size 626KB
Sample220422-tdmjkadfa2
SHA256 53839806f71da6c6fb1d6c27c34f3a0fc2fca1a651bae5e631d9958376110f85
MD5 aefbbecbc561abbbd1044bbd086ee83a
SHA1 4a2ee34a68639d86dd12acde3a9945cadd3aa373
SHA512 43f5d6aa9ed71ef7f2e18672fd291e32d94a42b0979c2bdb76fe105d8098ed7f0c56c720af8934d432ce56b1928fbb2a93c86e129b7203e0b8fae26d2f77c7f9
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 999 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

999

C2

config.edge.skype.com
146.70.35.138
146.70.35.142

Attributes

base_path
/phpadmin/
build
250227
exe_type
loader
extension
.src
server_id
50

rsa_pubkey.plain

aes.plain

Targets

- Target
  53839806f71da6c6fb1d6c27c34f3a0fc2fca1a651bae5e631d9958376110f85
- Size 626KB
- SHA256 53839806f71da6c6fb1d6c27c34f3a0fc2fca1a651bae5e631d9958376110f85
- MD5 aefbbecbc561abbbd1044bbd086ee83a
- SHA1 4a2ee34a68639d86dd12acde3a9945cadd3aa373
- SHA512 43f5d6aa9ed71ef7f2e18672fd291e32d94a42b0979c2bdb76fe105d8098ed7f0c56c720af8934d432ce56b1928fbb2a93c86e129b7203e0b8fae26d2f77c7f9
- MD5 SHA1 SHA512
Score

10^/10

gozi_ifsb 999 banker trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

gozi_ifsb999bankertrojan