Extracted

Extracted

• • Target
    5de5e3440620950f0be99fc6728c7afe
  • Size 428KB
  • SHA256 2d83e172a42b032b32606b203f2a1a9736acfd86e76ede8ff57b3292c035d139
  • MD5 5de5e3440620950f0be99fc6728c7afe
  • SHA1 43cbdfe6773ce518847b89f177a555e6bece283b
  • SHA512 674a545d51127efec4ad74ff97d6836a5a7c3f6c186de5a0be18bd1c619de4ffcd166409f52624b046ce4e48a0c432c2e19f6008741b8f117434229121f05c0e
  • MD5 SHA1 SHA512

  Score

  10^/10

  gozi_ifsb3000bankertrojansuricata

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb

  • suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

    suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

    suricata

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2