Overview

overview

10

Static

static

5f01a48664...c4.exe

windows7_x64

10

5f01a48664...c4.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5f01a4866431a17095c1b4b0eb6b6cd4ad221d4ff12bb2466280347abe3b13c4

  • Size

    658KB

  • Sample

    220701-eh3n1sbahj

  • MD5

    5cecd52c5f7a3a95392c2065e22a65ab

  • SHA1

    295c122ecaa4239532320f0deff4aa94ed92e207

  • SHA256

    5f01a4866431a17095c1b4b0eb6b6cd4ad221d4ff12bb2466280347abe3b13c4

  • SHA512

    a064a5bbd139b8115b37463904126aeab354facfe99c46bb1aed0f8dffabd91a03fe190772b9253f57f5061a75506018c12dfa0bcabee5e957151287bc2385a0

Score
10/10
gozi_ifsb1011bankerpersistencetrojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

1011

C2

http://h33a7jzovxp2dxfg.onion

http://check.vivianmaierphotos.com

http://mysweetdream.site

http://marcoplfind.at

http://maildeliveryyboys1.at
Attributes
  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    worker

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      5f01a4866431a17095c1b4b0eb6b6cd4ad221d4ff12bb2466280347abe3b13c4

    • Size

      658KB

    • MD5

      5cecd52c5f7a3a95392c2065e22a65ab

    • SHA1

      295c122ecaa4239532320f0deff4aa94ed92e207

    • SHA256

      5f01a4866431a17095c1b4b0eb6b6cd4ad221d4ff12bb2466280347abe3b13c4

    • SHA512

      a064a5bbd139b8115b37463904126aeab354facfe99c46bb1aed0f8dffabd91a03fe190772b9253f57f5061a75506018c12dfa0bcabee5e957151287bc2385a0

    Score
    10/10
    gozi_ifsb1011bankerpersistencetrojan

    • Gozi, Gozi IFSB

      Gozi ISFB is a well-known and widely distributed banking trojan.

      bankertrojangozi_ifsb

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks