gozi_ifsb | f2295303f97060f23752ff1eead52b21bc7529f91afb159325d3c4b98aaa52c4 | Triage

Analysis

max time kernel
84s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
01-07-2022 05:50

Sharing

Report Analysis Logs

General

Target

f2295303f97060f23752ff1eead52b21bc7529f91afb159325d3c4b98aaa52c4.exe
Size

232KB
MD5

089f70f85f41b829877a1c78bdc112ff
SHA1

dee3e3e382567b44ce6d69b175f2af3d5a22b4bf
SHA256

f2295303f97060f23752ff1eead52b21bc7529f91afb159325d3c4b98aaa52c4
SHA512

53c4c4e53f3e1b7961b74128418870b0ed463e73ab36eb8df9f573bf982c2a5f1b4c8cdaa4bc8d3f761f534344fae9193fb35eabccf2996c1454eae610235626

Score

10^/10

gozi_ifsb 3540 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Attributes

build
214107

Extracted

Family

gozi_ifsb

Botnet

3540

C2

settings-win.data.microsoft.com

jyomacktom.top

nxbpierrecjf.com

spt71igina.com

Attributes

build
214107
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

C:\Users\Admin\AppData\Local\Temp\f2295303f97060f23752ff1eead52b21bc7529f91afb159325d3c4b98aaa52c4.exe
"C:\Users\Admin\AppData\Local\Temp\f2295303f97060f23752ff1eead52b21bc7529f91afb159325d3c4b98aaa52c4.exe"
1⤵
PID:1352

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1352-55-0x0000000000100000-0x0000000000151000-memory.dmp

Filesize
324KB

Download
memory/1352-54-0x0000000000100000-0x000000000010E000-memory.dmp

Filesize
56KB

Download
memory/1352-56-0x0000000000180000-0x000000000018F000-memory.dmp

Filesize
60KB

Download
memory/1352-62-0x0000000000100000-0x0000000000151000-memory.dmp

Filesize
324KB

Download