gozi_ifsb | 796e8a60a4e111897b5c213058d35c1f016796379df9d1b9974e8a15a69d0731 | Triage

Sharing

General

Target

796e8a60a4e111897b5c213058d35c1f016796379df9d1b9974e8a15a69d0731
Size

203KB
Sample

220731-h473eafbep
MD5

99af6dc0784f14ef4fbf2d458b188797
SHA1

17f030a90f4a76cc5ff0dd7ad4d2feaed53f3dc1
SHA256

796e8a60a4e111897b5c213058d35c1f016796379df9d1b9974e8a15a69d0731
SHA512

3c626bc957612eacc00ca5c44f87814aa0516054f86cf7cd6713ae66f30872cd5fd8b24d9d94069a7904060ff35680203908b46f8f7939b8a2dce2c71e9d60da

Score

10^/10

gozi_ifsb 3162 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Attributes

build
215165

Extracted

Family

gozi_ifsb

Botnet

3162

C2

menehleibe.com

liemuteste.com

thulligend.com

Attributes

build
215165
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  796e8a60a4e111897b5c213058d35c1f016796379df9d1b9974e8a15a69d0731
- Size
  
  203KB
- MD5
  
  99af6dc0784f14ef4fbf2d458b188797
- SHA1
  
  17f030a90f4a76cc5ff0dd7ad4d2feaed53f3dc1
- SHA256
  
  796e8a60a4e111897b5c213058d35c1f016796379df9d1b9974e8a15a69d0731
- SHA512
  
  3c626bc957612eacc00ca5c44f87814aa0516054f86cf7cd6713ae66f30872cd5fd8b24d9d94069a7904060ff35680203908b46f8f7939b8a2dce2c71e9d60da
Score

10^/10

gozi_ifsb 3162 banker trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

gozi_ifsb3162bankertrojan

behavioral2

gozi_ifsb3162bankertrojan