gozi_ifsb | 22563b4281b0b954b66f63131e2209b02489601bdf947fe38fee049c1a9ef08a | Triage

Analysis

max time kernel
46s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12-06-2022 05:36

Sharing

Report Analysis Logs

General

Target

22563b4281b0b954b66f63131e2209b02489601bdf947fe38fee049c1a9ef08a.exe
Size

547KB
MD5

95f86ade7727100993143eba73680a4d
SHA1

ae3d9d3f4379c22dc4770c138dfb6a0ca25458c3
SHA256

22563b4281b0b954b66f63131e2209b02489601bdf947fe38fee049c1a9ef08a
SHA512

8f69f2eeb31ab7792e3d809daf4d120c78745cf5e6d2333220c7f5ef312b4413da261ae541eb0b3b10614c135c21fc697ee88180d4a605400f2dbada7619fe9e

Score

10^/10

gozi_ifsb 3187 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Attributes

build
214062

Extracted

Family

gozi_ifsb

Botnet

3187

C2

qrodericky94.company

g77yelsao.company

tromainevirginia.email

Attributes

build
214062
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com

ru

org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

C:\Users\Admin\AppData\Local\Temp\22563b4281b0b954b66f63131e2209b02489601bdf947fe38fee049c1a9ef08a.exe
"C:\Users\Admin\AppData\Local\Temp\22563b4281b0b954b66f63131e2209b02489601bdf947fe38fee049c1a9ef08a.exe"
1⤵
PID:1176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1176-130-0x0000000000D50000-0x0000000000D5F000-memory.dmp

Filesize
60KB

Download
memory/1176-131-0x0000000000D50000-0x0000000000DEE000-memory.dmp

Filesize
632KB

Download
memory/1176-132-0x0000000002930000-0x000000000294B000-memory.dmp

Filesize
108KB

Download