gozi_ifsb | 3bcb9d1db1e4a839f9c6b14acc4cc4e3473d19573fa93cbff6bb92e22079b10f | Triage

Sharing

General

Target

3bcb9d1db1e4a839f9c6b14acc4cc4e3473d19573fa93cbff6bb92e22079b10f
Size

344KB
Sample

220703-llf3ragae8
MD5

16fa52d00fefa45994b8b38b25d47d16
SHA1

aa74b4d7fed9fa7fdf1150ca8faa14903fd160b5
SHA256

3bcb9d1db1e4a839f9c6b14acc4cc4e3473d19573fa93cbff6bb92e22079b10f
SHA512

771e0ac6b16bc2f8b3cf12ce2f07d5358fa292b8383d894f9f8f4160de0c8a59eca1db8f4cb5956f9d789096a2ffee22619324d6224bd18f6391b4102bb24531

Score

10^/10

gozi_ifsb 3199 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Attributes

build
214062

Extracted

Family

gozi_ifsb

Botnet

3199

C2

wseo6lizzie.com

xcalebcleta.com

pyznvalerie.com

Attributes

build
214062
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  3bcb9d1db1e4a839f9c6b14acc4cc4e3473d19573fa93cbff6bb92e22079b10f
- Size
  
  344KB
- MD5
  
  16fa52d00fefa45994b8b38b25d47d16
- SHA1
  
  aa74b4d7fed9fa7fdf1150ca8faa14903fd160b5
- SHA256
  
  3bcb9d1db1e4a839f9c6b14acc4cc4e3473d19573fa93cbff6bb92e22079b10f
- SHA512
  
  771e0ac6b16bc2f8b3cf12ce2f07d5358fa292b8383d894f9f8f4160de0c8a59eca1db8f4cb5956f9d789096a2ffee22619324d6224bd18f6391b4102bb24531
Score

10^/10

gozi_ifsb 3199 banker trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

gozi_ifsb3199bankertrojan

behavioral2

gozi_ifsb3199bankertrojan