Overview

overview

10

Static

static

17e659d16e...cd.exe

windows7-x64

10

17e659d16e...cd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    17e659d16e3ddd71e5c99b69b1e104b379c20024087caec092e2436049c2f5cd

  • Size

    564KB

  • Sample

    221002-r23jkscefm

  • MD5

    7a8962a1c0d27e7a813e53a7dfbd8770

  • SHA1

    541a5ae5207f98c8d04d85d0541550169e49157f

  • SHA256

    17e659d16e3ddd71e5c99b69b1e104b379c20024087caec092e2436049c2f5cd

  • SHA512

    7f09775609e50611f4885f410ee9b26eca4477477fe8d751aa11a4d3f81eb00b67010f3041769e4991849b855ed9be634894f2e961fd15a412b1e94d4b4b7218

  • SSDEEP

    6144:wKEGlVcJboOtGY8q75yKC2qJDrNRlpwPBYgZ9fVU93eJwN6QFbSpO4XcA2n4aA8X:wKr3QboC9qLGKgZKe4HYpHvcbTGvmVj

Score
10/10
gozi_ifsbbankerevasionpersistencetrojan

Malware Config

Targets

    • Target

      17e659d16e3ddd71e5c99b69b1e104b379c20024087caec092e2436049c2f5cd

    • Size

      564KB

    • MD5

      7a8962a1c0d27e7a813e53a7dfbd8770

    • SHA1

      541a5ae5207f98c8d04d85d0541550169e49157f

    • SHA256

      17e659d16e3ddd71e5c99b69b1e104b379c20024087caec092e2436049c2f5cd

    • SHA512

      7f09775609e50611f4885f410ee9b26eca4477477fe8d751aa11a4d3f81eb00b67010f3041769e4991849b855ed9be634894f2e961fd15a412b1e94d4b4b7218

    • SSDEEP

      6144:wKEGlVcJboOtGY8q75yKC2qJDrNRlpwPBYgZ9fVU93eJwN6QFbSpO4XcA2n4aA8X:wKr3QboC9qLGKgZKe4HYpHvcbTGvmVj

    Score
    10/10
    evasionpersistencetrojangozi_ifsbbanker

    • Gozi, Gozi IFSB

      Gozi ISFB is a well-known and widely distributed banking trojan.

      bankertrojangozi_ifsb

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks