gozi_ifsb | 527df17bb8a43414368fbb7c66f7d32a44bd5a291e9ea734eaf49dbbba4578d4 | Triage

Sharing

General

Target

527df17bb8a43414368fbb7c66f7d32a44bd5a291e9ea734eaf49dbbba4578d4
Size

239KB
Sample

220717-db677achf7
MD5

8b18e0e10c8e418c04d5e4fa0f3a26bc
SHA1

94ce2a99cba9c9de0afccdcf747ba6c48298e68a
SHA256

527df17bb8a43414368fbb7c66f7d32a44bd5a291e9ea734eaf49dbbba4578d4
SHA512

0e3c54b46a490b8bdc872cd5693322d739b20276ee6369823df2654db73e4bdd7daf631b27703e045acb1f01802c2f898da095dedac42a6186dc529a3b69e161

Score

10^/10

gozi_ifsb 3474 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Attributes

build
214085

Extracted

Family

gozi_ifsb

Botnet

3474

C2

google.com

gmail.com

q982yeq23.xyz

t7763jykqeiy.com

hjruu.com

Attributes

build
214085
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  527df17bb8a43414368fbb7c66f7d32a44bd5a291e9ea734eaf49dbbba4578d4
- Size
  
  239KB
- MD5
  
  8b18e0e10c8e418c04d5e4fa0f3a26bc
- SHA1
  
  94ce2a99cba9c9de0afccdcf747ba6c48298e68a
- SHA256
  
  527df17bb8a43414368fbb7c66f7d32a44bd5a291e9ea734eaf49dbbba4578d4
- SHA512
  
  0e3c54b46a490b8bdc872cd5693322d739b20276ee6369823df2654db73e4bdd7daf631b27703e045acb1f01802c2f898da095dedac42a6186dc529a3b69e161
Score

10^/10

gozi_ifsb 3474 banker trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

gozi_ifsb3474bankertrojan

behavioral2

gozi_ifsb3474bankertrojan