gozi_ifsb | f2295303f97060f23752ff1eead52b21bc7529f91afb159325d3c4b98aaa52c4 | Triage

Sharing

General

Target

f2295303f97060f23752ff1eead52b21bc7529f91afb159325d3c4b98aaa52c4
Size

232KB
Sample

220701-gj3rhsgda6
MD5

089f70f85f41b829877a1c78bdc112ff
SHA1

dee3e3e382567b44ce6d69b175f2af3d5a22b4bf
SHA256

f2295303f97060f23752ff1eead52b21bc7529f91afb159325d3c4b98aaa52c4
SHA512

53c4c4e53f3e1b7961b74128418870b0ed463e73ab36eb8df9f573bf982c2a5f1b4c8cdaa4bc8d3f761f534344fae9193fb35eabccf2996c1454eae610235626

Score

10^/10

gozi_ifsb 3540 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Attributes

build
214107

Extracted

Family

gozi_ifsb

Botnet

3540

C2

settings-win.data.microsoft.com

jyomacktom.top

nxbpierrecjf.com

spt71igina.com

Attributes

build
214107
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  f2295303f97060f23752ff1eead52b21bc7529f91afb159325d3c4b98aaa52c4
- Size
  
  232KB
- MD5
  
  089f70f85f41b829877a1c78bdc112ff
- SHA1
  
  dee3e3e382567b44ce6d69b175f2af3d5a22b4bf
- SHA256
  
  f2295303f97060f23752ff1eead52b21bc7529f91afb159325d3c4b98aaa52c4
- SHA512
  
  53c4c4e53f3e1b7961b74128418870b0ed463e73ab36eb8df9f573bf982c2a5f1b4c8cdaa4bc8d3f761f534344fae9193fb35eabccf2996c1454eae610235626
Score

10^/10

gozi_ifsb 3540 banker trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

gozi_ifsb3540bankertrojan

behavioral2

gozi_ifsb3540bankertrojan