gozi_ifsb | 3d2dc979c48c7d4e31f121d7ad4ade654a6a7548cdc8fe3ce8ccd14aa144e968 | Triage

Analysis

max time kernel
26s
max time network
29s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
03-07-2022 03:58

Sharing

Report Analysis Logs

General

Target

3d2dc979c48c7d4e31f121d7ad4ade654a6a7548cdc8fe3ce8ccd14aa144e968.exe
Size

269KB
MD5

d10056f4e546eec4225fce9e5982cce1
SHA1

a7005756691aa3fa41bce3b70a944d69da0d36b3
SHA256

3d2dc979c48c7d4e31f121d7ad4ade654a6a7548cdc8fe3ce8ccd14aa144e968
SHA512

bd1d943e1c98ef03853b4626c6639e8a9b02abfd187af60b3c179185a25ae0ab84153af0e8c7a658f0218145a596619a0263a6ad641b62f7e8e27a5edadbb37a

Score

10^/10

gozi_ifsb 3151 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Attributes

build
215165

Extracted

Family

gozi_ifsb

Botnet

3151

C2

zardinglog.com

sycingshbo.com

imminesenc.com

Attributes

build
215165
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

C:\Users\Admin\AppData\Local\Temp\3d2dc979c48c7d4e31f121d7ad4ade654a6a7548cdc8fe3ce8ccd14aa144e968.exe
"C:\Users\Admin\AppData\Local\Temp\3d2dc979c48c7d4e31f121d7ad4ade654a6a7548cdc8fe3ce8ccd14aa144e968.exe"
1⤵
PID:460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/460-130-0x0000000000DC0000-0x0000000000DCF000-memory.dmp

Filesize
60KB

Download
memory/460-131-0x0000000000DC0000-0x0000000000E13000-memory.dmp

Filesize
332KB

Download
memory/460-132-0x00000000027E0000-0x00000000027FB000-memory.dmp

Filesize
108KB

Download