gozi_ifsb | 64d01ed1bbe05ae4ca42b4e3437fd4bad69febf0637da7f4ede9c889bb1eaf34 | Triage

Analysis

max time kernel
1s
platform
windows7_x64
resource
win7-20220414-en
submitted
25-06-2022 01:51

Sharing

Report Analysis Logs

General

Target

64d01ed1bbe05ae4ca42b4e3437fd4bad69febf0637da7f4ede9c889bb1eaf34.exe
Size

299KB
MD5

474adcbbd56545e775b13d1ea3048d10
SHA1

c5507feb50d4ad3a60807fb6942317838b7f3a56
SHA256

64d01ed1bbe05ae4ca42b4e3437fd4bad69febf0637da7f4ede9c889bb1eaf34
SHA512

b833ea8bd93a33a147c6dc9448123a0500c026c7775367cb813b08c64d653c187f17464d5805965a2ff89fa9c9282e372f61ab10814d1fea3949f49b374c0d36

Score

10^/10

gozi_ifsb 2000 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

2000

C2

ax.ikobut.at/webstore

beetfeetlife.bit/webstore

foo.avaregio.at/webstore

api.hamanana.at/webstore

api.ikobut.at/webstore

supp.zapkopw.at/webstore

cdn.avaregio.at/webstore

Attributes

build
217061
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
dns_servers
193.183.98.66
91.217.137.37
192.71.245.208
8.8.8.8
178.17.170.179
82.196.9.45
151.80.222.79
68.183.70.217
217.144.135.7
158.69.160.164
207.148.83.241
5.189.170.196
217.144.132.148
94.247.43.254
188.165.200.156
159.89.249.249
150.249.149.222
exe_type
loader
server_id
550

rsa_pubkey.plain

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

C:\Users\Admin\AppData\Local\Temp\64d01ed1bbe05ae4ca42b4e3437fd4bad69febf0637da7f4ede9c889bb1eaf34.exe
"C:\Users\Admin\AppData\Local\Temp\64d01ed1bbe05ae4ca42b4e3437fd4bad69febf0637da7f4ede9c889bb1eaf34.exe"
1⤵
PID:1972

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1972-54-0x0000000000300000-0x000000000031B000-memory.dmp

Filesize
108KB

Download
memory/1972-57-0x00000000002B0000-0x00000000002BF000-memory.dmp

Filesize
60KB

Download
memory/1972-58-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download