gozi_ifsb | fd35940bf6701f7d98b39196b19273c86c74757ca2c226cff607fa23df183e03 | Triage

Sharing

General

Target

fd35940bf6701f7d98b39196b19273c86c74757ca2c226cff607fa23df183e03
Size

589KB
Sample

221022-mkt4nacde7
MD5

4f2aee8563f78102b67ea3f6d9b9166b
SHA1

518888baf0266a9638d20fd04cb5727f864d3b39
SHA256

fd35940bf6701f7d98b39196b19273c86c74757ca2c226cff607fa23df183e03
SHA512

e3f198d7d8a7e37613e16e6b468efc88891a25cd524a2084eee314ea56e8f34efbd513f8741224d06361d0e5fcf5cab631beecddf08142118c2d58569ee8f77a
SSDEEP

12288:NymJLjgQUqkZTwa6vcUpO59Nu6FaLLCvtd:nJ3gQUhZ85kz5b2HC

Score

10^/10

gozi_ifsb 4463 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

4463

C2

1.microsoft.com

silugerude.xyz

vilugerude.xyz

Attributes

base_path
/palok/
build
250193
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
exe_type
loader
extension
.trb
server_id
12

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  fd35940bf6701f7d98b39196b19273c86c74757ca2c226cff607fa23df183e03
- Size
  
  589KB
- MD5
  
  4f2aee8563f78102b67ea3f6d9b9166b
- SHA1
  
  518888baf0266a9638d20fd04cb5727f864d3b39
- SHA256
  
  fd35940bf6701f7d98b39196b19273c86c74757ca2c226cff607fa23df183e03
- SHA512
  
  e3f198d7d8a7e37613e16e6b468efc88891a25cd524a2084eee314ea56e8f34efbd513f8741224d06361d0e5fcf5cab631beecddf08142118c2d58569ee8f77a
- SSDEEP
  
  12288:NymJLjgQUqkZTwa6vcUpO59Nu6FaLLCvtd:nJ3gQUhZ85kz5b2HC
Score

10^/10

gozi_ifsb 4463 banker trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

gozi_ifsb4463bankertrojan

behavioral2

gozi_ifsb4463bankertrojan