Overview

overview

10

Static

static

b08cef1d01...22.dll

windows7_x64

10

b08cef1d01...22.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b08cef1d01353f794ac2fe61edc97100fbabf82bc9489288c1d8c30fe8221822

  • Size

    397KB

  • Sample

    220512-r35ekagha6

  • MD5

    98b18cdd57be2e9c4cbe26882dbed293

  • SHA1

    1e97f13752d17288b8407d7a9915272c29ba7086

  • SHA256

    b08cef1d01353f794ac2fe61edc97100fbabf82bc9489288c1d8c30fe8221822

  • SHA512

    eaac08996089a7bf37f506ac253b69c7bf3fc3c09811f3814f0743f7598639badd17e3c3c7edf99b4496c096758199f372687acf14af261a997304bedea23012

Score
10/10
gozi_ifsb2200bankersuricatatrojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

2200

C2

api10.laptok.at/api1

Attributes
  • build

    250155

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    730

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      b08cef1d01353f794ac2fe61edc97100fbabf82bc9489288c1d8c30fe8221822

    • Size

      397KB

    • MD5

      98b18cdd57be2e9c4cbe26882dbed293

    • SHA1

      1e97f13752d17288b8407d7a9915272c29ba7086

    • SHA256

      b08cef1d01353f794ac2fe61edc97100fbabf82bc9489288c1d8c30fe8221822

    • SHA512

      eaac08996089a7bf37f506ac253b69c7bf3fc3c09811f3814f0743f7598639badd17e3c3c7edf99b4496c096758199f372687acf14af261a997304bedea23012

    Score
    10/10
    gozi_ifsb2200bankertrojansuricata

    • Gozi, Gozi IFSB

      Gozi ISFB is a well-known and widely distributed banking trojan.

      bankertrojangozi_ifsb

    • suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

      suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

      suricata
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks