gozi_ifsb | 2d7e27ba0ccb83128f46bcbfba5cc7673ffd8b8907b209510949d07acf1b67c3 | Triage

Sharing

General

Target

2d7e27ba0ccb83128f46bcbfba5cc7673ffd8b8907b209510949d07acf1b67c3
Size

330KB
Sample

221020-zarxrsddbk
MD5

57747bf1775275e0425ae0f364c91710
SHA1

d6f1fea65f8cdd5584bcdf3de7e1535612f69817
SHA256

2d7e27ba0ccb83128f46bcbfba5cc7673ffd8b8907b209510949d07acf1b67c3
SHA512

3ae9aa3d3c80ad325bf4dcbd6d6f95dc3b0a6058a00cac15a4800cea2408d5d9f702f4a3f43e730d651b2a4abd9e008eb104b836d7fc511f70e242cd0f7a0d67
SSDEEP

6144:pa6yGxGrMU+OzcapV2WvnZ4leSHhTO43NzMygTt1HW/jeLR7n+:pa9GxGwUcmUWvIHhq+MB5WKtn+

Score

10^/10

gozi_ifsb banker bootkit persistence trojan

Malware Config

Targets

- Target
  
  2d7e27ba0ccb83128f46bcbfba5cc7673ffd8b8907b209510949d07acf1b67c3
- Size
  
  330KB
- MD5
  
  57747bf1775275e0425ae0f364c91710
- SHA1
  
  d6f1fea65f8cdd5584bcdf3de7e1535612f69817
- SHA256
  
  2d7e27ba0ccb83128f46bcbfba5cc7673ffd8b8907b209510949d07acf1b67c3
- SHA512
  
  3ae9aa3d3c80ad325bf4dcbd6d6f95dc3b0a6058a00cac15a4800cea2408d5d9f702f4a3f43e730d651b2a4abd9e008eb104b836d7fc511f70e242cd0f7a0d67
- SSDEEP
  
  6144:pa6yGxGrMU+OzcapV2WvnZ4leSHhTO43NzMygTt1HW/jeLR7n+:pa9GxGwUcmUWvIHhq+MB5WKtn+
Score

10^/10

gozi_ifsb banker bootkit persistence trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
- Deletes itself
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

Hidden Files and Directories

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

gozi_ifsbbankerbootkitpersistencetrojan

behavioral2