gozi_ifsb | 3d2dc979c48c7d4e31f121d7ad4ade654a6a7548cdc8fe3ce8ccd14aa144e968 | Triage

Analysis

max time kernel
117s
max time network
44s
platform
windows7_x64
resource
win7-20220414-en
submitted
03-07-2022 03:58

Sharing

Report Analysis Logs

General

Target

3d2dc979c48c7d4e31f121d7ad4ade654a6a7548cdc8fe3ce8ccd14aa144e968.exe
Size

269KB
MD5

d10056f4e546eec4225fce9e5982cce1
SHA1

a7005756691aa3fa41bce3b70a944d69da0d36b3
SHA256

3d2dc979c48c7d4e31f121d7ad4ade654a6a7548cdc8fe3ce8ccd14aa144e968
SHA512

bd1d943e1c98ef03853b4626c6639e8a9b02abfd187af60b3c179185a25ae0ab84153af0e8c7a658f0218145a596619a0263a6ad641b62f7e8e27a5edadbb37a

Score

10^/10

gozi_ifsb 3151 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Attributes

build
215165

Extracted

Family

gozi_ifsb

Botnet

3151

C2

zardinglog.com

sycingshbo.com

imminesenc.com

Attributes

build
215165
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

C:\Users\Admin\AppData\Local\Temp\3d2dc979c48c7d4e31f121d7ad4ade654a6a7548cdc8fe3ce8ccd14aa144e968.exe
"C:\Users\Admin\AppData\Local\Temp\3d2dc979c48c7d4e31f121d7ad4ade654a6a7548cdc8fe3ce8ccd14aa144e968.exe"
1⤵
PID:784

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/784-55-0x0000000001080000-0x00000000010D3000-memory.dmp

Filesize
332KB

Download
memory/784-54-0x0000000001080000-0x000000000108F000-memory.dmp

Filesize
60KB

Download
memory/784-56-0x0000000000160000-0x000000000017B000-memory.dmp

Filesize
108KB

Download