Overview

overview

10

Static

static

8

3af18232a9...32.exe

windows7_x64

10

3af18232a9...32.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3af18232a9175dea624a7947e6edef6a57457bdf6d3ba0ead58856a139db2832

  • Size

    345KB

  • Sample

    220703-wyq4labgcn

  • MD5

    4da11c829f8fea1b690f317837af8387

  • SHA1

    00c6ce1031f88b5276a5335e68fba663e769dadd

  • SHA256

    3af18232a9175dea624a7947e6edef6a57457bdf6d3ba0ead58856a139db2832

  • SHA512

    dfa1e0fe39a8262d987516556d78e395ea7f01cbbfa471296e9f3352c4ae8b80a3305c21352a8ea67e25bd2047edcb30dfe0c319671f9daab86e79f8a781b2d5

Score
10/10
gozi_ifsbbankertrojanupx

Malware Config

Targets

    • Target

      3af18232a9175dea624a7947e6edef6a57457bdf6d3ba0ead58856a139db2832

    • Size

      345KB

    • MD5

      4da11c829f8fea1b690f317837af8387

    • SHA1

      00c6ce1031f88b5276a5335e68fba663e769dadd

    • SHA256

      3af18232a9175dea624a7947e6edef6a57457bdf6d3ba0ead58856a139db2832

    • SHA512

      dfa1e0fe39a8262d987516556d78e395ea7f01cbbfa471296e9f3352c4ae8b80a3305c21352a8ea67e25bd2047edcb30dfe0c319671f9daab86e79f8a781b2d5

    Score
    10/10
    gozi_ifsbbankertrojanupx

    • Gozi, Gozi IFSB

      Gozi ISFB is a well-known and widely distributed banking trojan.

      bankertrojangozi_ifsb

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks