gozi_ifsb | 3b0e728e044d1f2ce3bf6a32a4a38084128f84a80b6b9576e9db4d43ffb9f91c | Triage

Analysis

max time kernel
32s
platform
windows7_x64
resource
win7-20220414-en
submitted
03-07-2022 17:59

Sharing

Report Analysis Logs

General

Target

3b0e728e044d1f2ce3bf6a32a4a38084128f84a80b6b9576e9db4d43ffb9f91c.exe
Size

376KB
MD5

85e9103788fd48d7dc3c1a911da9d15a
SHA1

ab740ef7da6decf5b86281af5d38f3933f9d6234
SHA256

3b0e728e044d1f2ce3bf6a32a4a38084128f84a80b6b9576e9db4d43ffb9f91c
SHA512

257be0c36a3a4b1d5954809ba2a501fca07565f5b883df0d62ea379dd15ec7dceea730cfad0f69dfd80cafff2983f913a7f0d236e7a23d4e5389c6a022730c4a

Score

10^/10

gozi_ifsb 3195 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

3195

C2

nsyblefgg.city

m25lni11528.com

dgrover.band

Attributes

build
214062
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

C:\Users\Admin\AppData\Local\Temp\3b0e728e044d1f2ce3bf6a32a4a38084128f84a80b6b9576e9db4d43ffb9f91c.exe
"C:\Users\Admin\AppData\Local\Temp\3b0e728e044d1f2ce3bf6a32a4a38084128f84a80b6b9576e9db4d43ffb9f91c.exe"
1⤵
PID:1968

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-54-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

Filesize
8KB

Download
memory/1968-55-0x0000000000CF0000-0x0000000000CFF000-memory.dmp

Filesize
60KB

Download
memory/1968-56-0x0000000000CF0000-0x0000000000D5F000-memory.dmp

Filesize
444KB

Download
memory/1968-57-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download