gozi_ifsb | 50deb8a6310132fa14cf8df84b21d28d1966a2e74462bc3d283617cc1a3e5736 | Triage

Sharing

General

Target

50deb8a6310132fa14cf8df84b21d28d1966a2e74462bc3d283617cc1a3e5736
Size

372KB
Sample

220718-ybsd9afhar
MD5

5caa828cbf84e3ee6b3400cdce9cff80
SHA1

83f2886ebfc1ab8c975567adf82005d8f6db6665
SHA256

50deb8a6310132fa14cf8df84b21d28d1966a2e74462bc3d283617cc1a3e5736
SHA512

fc31ff5cb59629335fb4020ad78434bc1a4771446b0fe8f19a86d5b761a06d3bfe570fb93722accf26c92cabcff28afc570829baed20738280fd024a295fb2e8

Score

10^/10

gozi_ifsb 3181 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Attributes

build
214062

Extracted

Family

gozi_ifsb

Botnet

3181

C2

bm25yp.com

xiivhaaou.email

m264591jasen.city

Attributes

build
214062
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  50deb8a6310132fa14cf8df84b21d28d1966a2e74462bc3d283617cc1a3e5736
- Size
  
  372KB
- MD5
  
  5caa828cbf84e3ee6b3400cdce9cff80
- SHA1
  
  83f2886ebfc1ab8c975567adf82005d8f6db6665
- SHA256
  
  50deb8a6310132fa14cf8df84b21d28d1966a2e74462bc3d283617cc1a3e5736
- SHA512
  
  fc31ff5cb59629335fb4020ad78434bc1a4771446b0fe8f19a86d5b761a06d3bfe570fb93722accf26c92cabcff28afc570829baed20738280fd024a295fb2e8
Score

10^/10

gozi_ifsb 3181 banker trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

gozi_ifsb3181bankertrojan

behavioral2

gozi_ifsb3181bankertrojan