Extracted

Extracted

• • Target
    43f77bef5d051fd5cf1eac78264dc8b6256d2730cec0c50e320f4ca95068ddb7
  • Size 624KB
  • SHA256 43f77bef5d051fd5cf1eac78264dc8b6256d2730cec0c50e320f4ca95068ddb7
  • MD5 eacf09cda9379b87bb49a1a7cdee1a53
  • SHA1 047fe708e9bed095deaa581d0a3adbc02847226b
  • SHA512 0ac6bf571758fbda2a38bc3a16fc7b9184b18e195c27e3843ec4de6f4e0ea0e5cf330ed5a2b251b5e2a467db0d552443b7cebe91d372cb49afaf33d2b2d13857
  • MD5 SHA1 SHA512

  Score

  10^/10

  gozi_ifsb999bankersuricatatrojan

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb

  • suricata: ET MALWARE Ursnif Payload Request (cook32.rar)

    suricata: ET MALWARE Ursnif Payload Request (cook32.rar)

    suricata

  • suricata: ET MALWARE Ursnif Payload Request (cook64.rar)

    suricata: ET MALWARE Ursnif Payload Request (cook64.rar)

    suricata

  • suricata: ET MALWARE Ursnif Variant CnC Beacon

    suricata: ET MALWARE Ursnif Variant CnC Beacon

    suricata

  • suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

    suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

    suricata

  • suricata: ET MALWARE Ursnif Variant CnC Data Exfil

    suricata: ET MALWARE Ursnif Variant CnC Data Exfil

    suricata

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Suspicious use of SetThreadContext

  behavioral1