gozi_ifsb | 01662199ff539f8f59b7fa225660cf220ba6d06c1b1a95e1f7fb94686f68c66f | Triage

Analysis

max time kernel
59s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
23-05-2022 20:01

Sharing

Report Analysis Logs

General

Target

01662199ff539f8f59b7fa225660cf220ba6d06c1b1a95e1f7fb94686f68c66f.exe
Size

372KB
MD5

d4beedd92a2d75858ed2476052820ab0
SHA1

d64585e9611013363ee86e44c88f19328b0ae3df
SHA256

01662199ff539f8f59b7fa225660cf220ba6d06c1b1a95e1f7fb94686f68c66f
SHA512

4f248cb45318ea68e5fe1e9b4f2a5fcd748f888b23fa3a6d12021e616ff07730c24c17682e24057f7349039787126a990adf75e93e916e7ef8dd1eefb36475ec

Score

10^/10

gozi_ifsb 3181 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Attributes

build
214062

Extracted

Family

gozi_ifsb

Botnet

3181

C2

bm25yp.com

xiivhaaou.email

m264591jasen.city

Attributes

build
214062
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

C:\Users\Admin\AppData\Local\Temp\01662199ff539f8f59b7fa225660cf220ba6d06c1b1a95e1f7fb94686f68c66f.exe
"C:\Users\Admin\AppData\Local\Temp\01662199ff539f8f59b7fa225660cf220ba6d06c1b1a95e1f7fb94686f68c66f.exe"
1⤵
PID:2004

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2004-54-0x0000000076191000-0x0000000076193000-memory.dmp

Filesize
8KB

Download
memory/2004-55-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2004-56-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2004-57-0x0000000000310000-0x000000000032B000-memory.dmp

Filesize
108KB

Download