gozi_ifsb | 607271fd170d7178677d6d975d2324091a0864086872cbe3aebcbed0ff02bb5a | Triage

Sharing

General

Target

607271fd170d7178677d6d975d2324091a0864086872cbe3aebcbed0ff02bb5a
Size

203KB
Sample

220731-fcb5jsggd7
MD5

60fe004e75985467b0082a7ff2d2177b
SHA1

82723838799d5103db0210f62b6dbf37aaf87b96
SHA256

607271fd170d7178677d6d975d2324091a0864086872cbe3aebcbed0ff02bb5a
SHA512

62414f1f84de3ddd075627498f7640e037c52fd489b5b20a2268f193ba45fa141c3f1a14538bba849090484f6c2c8b6c7e5b510335b9e26560c9c16bb2f6dbf6

Score

10^/10

gozi_ifsb 3162 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Attributes

build
215165

Extracted

Family

gozi_ifsb

Botnet

3162

C2

menehleibe.com

liemuteste.com

thulligend.com

Attributes

build
215165
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  607271fd170d7178677d6d975d2324091a0864086872cbe3aebcbed0ff02bb5a
- Size
  
  203KB
- MD5
  
  60fe004e75985467b0082a7ff2d2177b
- SHA1
  
  82723838799d5103db0210f62b6dbf37aaf87b96
- SHA256
  
  607271fd170d7178677d6d975d2324091a0864086872cbe3aebcbed0ff02bb5a
- SHA512
  
  62414f1f84de3ddd075627498f7640e037c52fd489b5b20a2268f193ba45fa141c3f1a14538bba849090484f6c2c8b6c7e5b510335b9e26560c9c16bb2f6dbf6
Score

10^/10

gozi_ifsb 3162 banker trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

gozi_ifsb3162bankertrojan

behavioral2

gozi_ifsb3162bankertrojan