gozi_ifsb | a30f99cc6d3f228935a222835ed40ae97274fbb35750c08266c6183f389e7e01 | Triage

Analysis

max time kernel
32s
max time network
42s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2022 07:07

Sharing

Report Analysis Logs

General

Target

a30f99cc6d3f228935a222835ed40ae97274fbb35750c08266c6183f389e7e01.exe
Size

648KB
MD5

6ef1d7ce9cb2997a1546df256f3a5b24
SHA1

23d3ecd007fdd59f039f06e98b5687d1b70482fc
SHA256

a30f99cc6d3f228935a222835ed40ae97274fbb35750c08266c6183f389e7e01
SHA512

134e31d867f5d3b8d9193f8af7e438a787d4319ac9660690fe9ff4e6e00897792e2aad2ea9f45f5358ee6b142219660446d98fa514c5ea268f1e7fb26040086b

Score

10^/10

gozi_ifsb 3189 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Attributes

build
214062

Extracted

Family

gozi_ifsb

Botnet

3189

C2

hfmjerrodo.com

w19jackyivah.com

l15uniquekylie.city

Attributes

build
214062
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

C:\Users\Admin\AppData\Local\Temp\a30f99cc6d3f228935a222835ed40ae97274fbb35750c08266c6183f389e7e01.exe
"C:\Users\Admin\AppData\Local\Temp\a30f99cc6d3f228935a222835ed40ae97274fbb35750c08266c6183f389e7e01.exe"
1⤵
PID:2212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2212-131-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2212-130-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2212-132-0x00000000022F0000-0x000000000230B000-memory.dmp

Filesize
108KB

Download