gozi_ifsb | 453f00880f8ccb1e1fe5a84954d1026f206cd4158f1f7178d3a7416be7e2384a | Triage

Sharing

General

Target

453f00880f8ccb1e1fe5a84954d1026f206cd4158f1f7178d3a7416be7e2384a
Size

455KB
Sample

220707-tyw9habadm
MD5

990e267c3567ace78d1fa160b3af9562
SHA1

fae624d84de4e5b9f9ee4949964321af18eec808
SHA256

453f00880f8ccb1e1fe5a84954d1026f206cd4158f1f7178d3a7416be7e2384a
SHA512

afeeb8cfd2520276c50e9f18728f16e71a363cef16640a64712d5909bd3b96894473384c724c22ee916c4ae2cf134140912b86938f30b1b5b61e043a7d427018

Score

10^/10

gozi_ifsb 3183 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Attributes

build
214062

Extracted

Family

gozi_ifsb

Botnet

3183

C2

v99jarret3287x.com

huymireyai.company

so64a92elody.email

Attributes

build
214062
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com

ru

org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  453f00880f8ccb1e1fe5a84954d1026f206cd4158f1f7178d3a7416be7e2384a
- Size
  
  455KB
- MD5
  
  990e267c3567ace78d1fa160b3af9562
- SHA1
  
  fae624d84de4e5b9f9ee4949964321af18eec808
- SHA256
  
  453f00880f8ccb1e1fe5a84954d1026f206cd4158f1f7178d3a7416be7e2384a
- SHA512
  
  afeeb8cfd2520276c50e9f18728f16e71a363cef16640a64712d5909bd3b96894473384c724c22ee916c4ae2cf134140912b86938f30b1b5b61e043a7d427018
Score

10^/10

gozi_ifsb 3183 banker trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

gozi_ifsb3183bankertrojan

behavioral2

gozi_ifsb3183bankertrojan