Overview

overview

10

Static

static

1479.lnk

windows7-x64

10

1479.lnk

windows10-2004-x64

10

internee/b...es.dll

windows7-x64

10

internee/b...es.dll

windows10-2004-x64

10

internee/champ.cmd

windows7-x64

1

internee/champ.cmd

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    1479.iso
  • Size 418KB
  • Sample221019-mrbkwsfhal
  • SHA256 934d35b702d4339f22b374ff4b7ea79daaa8546b7551e3b3bd8493bd8e084515
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
gozi_ifsb5000bankertrojan

Malware Config

Extracted

Family

  • gozi_ifsb

Botnet

  • 5000

C2

  • config.edge.skype.com

  • onlinetwork.top

  • linetwork.top

Attributes
  • base_path

    /drew/

  • build

    250246

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Targets

    • Target
      1479.lnk
    • Size 1KB
    • SHA256 95d75f9f60c28efec7ec43966a0379063aa9c7ca5351f23c77dc3e67050f559a
    • MD5 SHA1 SHA512
    Score
    10/10
    gozi_ifsb5000bankertrojan

    • Gozi, Gozi IFSB

      Gozi ISFB is a well-known and widely distributed banking trojan.

      bankertrojangozi_ifsb

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2
    • Target
      internee/boutiques.3ds
    • Size 116KB
    • SHA256 d49394ac9e0a118afe5115a2206d5f815dbc0816f7507a860a297c941f88ebfa
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    gozi_ifsb5000bankertrojan
    behavioral3behavioral4
    • Target
      internee/champ.cmd
    • Size 381B
    • SHA256 98f7f620659ea608a3753f036bd64d64a41661374b7b10fc42e276af0d91af59
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral5behavioral6

MITRE ATT&CK Enterprise v6

Tasks