gozi_ifsb | 33379979fe354b26a88051f4cd28ce99a03a8e00a16764118c70b5a4b9397f56 | Triage

Sharing

General

Target

33379979fe354b26a88051f4cd28ce99a03a8e00a16764118c70b5a4b9397f56
Size

162KB
Sample

220620-dtaxpscgbn
MD5

01002450f7df9f0b90056cfe330d3968
SHA1

400865a26d05900943d1e5e3a2347a52fc7fad7c
SHA256

33379979fe354b26a88051f4cd28ce99a03a8e00a16764118c70b5a4b9397f56
SHA512

481d46d1137533dc0fcb822c2ffd273e4990904543f2c6afa6a2d9a6de805f8d75f7368252a4f71fbb9a346304c8f0ab003df6572c3f59a04ab1052619d72754

Score

10^/10

gozi_ifsb 3529 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Attributes

build
214107

Extracted

Family

gozi_ifsb

Botnet

3529

C2

gmail.com

google.com

nfyuabel.com

rwoodrowyioay.com

gqx21mcou.com

Attributes

build
214107
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  33379979fe354b26a88051f4cd28ce99a03a8e00a16764118c70b5a4b9397f56
- Size
  
  162KB
- MD5
  
  01002450f7df9f0b90056cfe330d3968
- SHA1
  
  400865a26d05900943d1e5e3a2347a52fc7fad7c
- SHA256
  
  33379979fe354b26a88051f4cd28ce99a03a8e00a16764118c70b5a4b9397f56
- SHA512
  
  481d46d1137533dc0fcb822c2ffd273e4990904543f2c6afa6a2d9a6de805f8d75f7368252a4f71fbb9a346304c8f0ab003df6572c3f59a04ab1052619d72754
Score

10^/10

gozi_ifsb 3529 banker trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

gozi_ifsb3529bankertrojan

behavioral2

gozi_ifsb3529bankertrojan