gozi_ifsb | c739b9d1c5160808a9132a772ac94defad65972b3e95bf3666bec0c341b72f0d

General

Target
c739b9d1c5160808a9132a772ac94defad65972b3e95bf3666bec0c341b72f0d
Size 496KB
Sample221004-bp71jafda3
SHA256 c739b9d1c5160808a9132a772ac94defad65972b3e95bf3666bec0c341b72f0d
MD5 542f9348faf21c536fa0a060a1e4b350
SHA1 0ac6f395ce0d0701b92cef066b8164c0a8c9290f
SHA512 11e843da928b1adfc80c28886be688fd48a40563567ce6aff5e932ea6a26981af5e915567f77831003150b220f0e1b81dcf01cd0cc408f07f2f3024594d9641b
SSDEEP 12288:LqPMJ0RNG3GZXnRe7T0Zr55h9sb3Qt/hs:1JKOG1nR6wVLuQti
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

gozi_ifsb

Botnet

3000

C2

unikymprogress.ru

Attributes

exe_type
worker
server_id
12

rsa_pubkey.plain

serpent.plain

Targets

- Target
  c739b9d1c5160808a9132a772ac94defad65972b3e95bf3666bec0c341b72f0d
- Size 496KB
- SHA256 c739b9d1c5160808a9132a772ac94defad65972b3e95bf3666bec0c341b72f0d
- MD5 542f9348faf21c536fa0a060a1e4b350
- SHA1 0ac6f395ce0d0701b92cef066b8164c0a8c9290f
- SHA512 11e843da928b1adfc80c28886be688fd48a40563567ce6aff5e932ea6a26981af5e915567f77831003150b220f0e1b81dcf01cd0cc408f07f2f3024594d9641b
- SSDEEP 12288:LqPMJ0RNG3GZXnRe7T0Zr55h9sb3Qt/hs:1JKOG1nR6wVLuQti
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

gozi_ifsb 3000 banker evasion persistence trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Gozi, Gozi IFSB

Windows security bypass

Executes dropped EXE

Loads dropped DLL

Windows security modification

Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2