gozi_ifsb | 3c715a2541eccac53f39a9eddc3bb562a12734293fb46cfbae99d27f7a8f33df | Triage

Analysis

max time kernel
26s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
03-07-2022 07:28

Sharing

Report Analysis Logs

General

Target

3c715a2541eccac53f39a9eddc3bb562a12734293fb46cfbae99d27f7a8f33df.exe
Size

270KB
MD5

5d9ae4e42abe5ba1fc90b6d905c1f14b
SHA1

82f9a681a9a4fc344657a0a93dd74295949c4eec
SHA256

3c715a2541eccac53f39a9eddc3bb562a12734293fb46cfbae99d27f7a8f33df
SHA512

cd49a9bfe3d4e478401f7e231f3339fb4a139a1f90a47f97729fbff2cda76583876b27055849d2d7565d13404da2e912704e54cbb8eedc38a2d72808d65175f6

Score

10^/10

gozi_ifsb 3420 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Attributes

build
214085

Extracted

Family

gozi_ifsb

Botnet

3420

C2

google.com

gmail.com

goarebecao.club

gjoannemajor.com

bsamnz.com

Attributes

build
214085
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

C:\Users\Admin\AppData\Local\Temp\3c715a2541eccac53f39a9eddc3bb562a12734293fb46cfbae99d27f7a8f33df.exe
"C:\Users\Admin\AppData\Local\Temp\3c715a2541eccac53f39a9eddc3bb562a12734293fb46cfbae99d27f7a8f33df.exe"
1⤵
PID:924

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/924-55-0x0000000000330000-0x000000000037F000-memory.dmp

Filesize
316KB

Download
memory/924-54-0x0000000000330000-0x000000000033E000-memory.dmp

Filesize
56KB

Download
memory/924-56-0x0000000000140000-0x000000000014F000-memory.dmp

Filesize
60KB

Download