gozi_ifsb | 5e5b414b0393c124c913722f61ff743780b39be63106647100fbcf81e8f36c13 | Triage

Sharing

General

Target

5e5b414b0393c124c913722f61ff743780b39be63106647100fbcf81e8f36c13
Size

372KB
Sample

220731-zbbbeagcem
MD5

890d334df6514ad11c7c19cf91e7495f
SHA1

881bae1fc560899478f6e08b70ea921b8cb4d4ba
SHA256

5e5b414b0393c124c913722f61ff743780b39be63106647100fbcf81e8f36c13
SHA512

42c01ac60762c626a493fa3e5b39e9f09bde502db9bf3b1f1a312858dc966e3d7160f771a98f6986f6ba019075befa96a5151ad7073a8bebb8ec9f052f6e8639

Score

10^/10

gozi_ifsb 3181 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Attributes

build
214062

Extracted

Family

gozi_ifsb

Botnet

3181

C2

bm25yp.com

xiivhaaou.email

m264591jasen.city

Attributes

build
214062
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  5e5b414b0393c124c913722f61ff743780b39be63106647100fbcf81e8f36c13
- Size
  
  372KB
- MD5
  
  890d334df6514ad11c7c19cf91e7495f
- SHA1
  
  881bae1fc560899478f6e08b70ea921b8cb4d4ba
- SHA256
  
  5e5b414b0393c124c913722f61ff743780b39be63106647100fbcf81e8f36c13
- SHA512
  
  42c01ac60762c626a493fa3e5b39e9f09bde502db9bf3b1f1a312858dc966e3d7160f771a98f6986f6ba019075befa96a5151ad7073a8bebb8ec9f052f6e8639
Score

10^/10

gozi_ifsb 3181 banker trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

gozi_ifsb3181bankertrojan

behavioral2

gozi_ifsb3181bankertrojan