Overview

overview

10

Static

static

b75ff77aca...92.exe

windows7-x64

10

b75ff77aca...92.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b75ff77aca9a25acf4c0ad94853385d2a3ec188d4a6066eb5b3c7dcc52c0a692

  • Size

    569KB

  • Sample

    221023-yj6lvacbd4

  • MD5

    b903665c8fbd50d6bf8cdd3fb2925146

  • SHA1

    6236fccb03ebe21b5b8d72443d4edf71384c045c

  • SHA256

    b75ff77aca9a25acf4c0ad94853385d2a3ec188d4a6066eb5b3c7dcc52c0a692

  • SHA512

    ad0a270a857b2165513bb0f2a0ee32c6d343149d1faaca0b735733d177af1c11cbe5ead694bf7e9a106017fb56023b779dfad4f6ceccc5b91fd3e9b890c187c5

  • SSDEEP

    12288:paIJZRxQe8CBNKJ/3ISJFiT32e6MJE+8MOUBXiPb:0ID8aB0F4Sjm2e5+jWiPb

Score
10/10
gozi_ifsbbankerpersistencetrojan

Malware Config

Targets

    • Target

      b75ff77aca9a25acf4c0ad94853385d2a3ec188d4a6066eb5b3c7dcc52c0a692

    • Size

      569KB

    • MD5

      b903665c8fbd50d6bf8cdd3fb2925146

    • SHA1

      6236fccb03ebe21b5b8d72443d4edf71384c045c

    • SHA256

      b75ff77aca9a25acf4c0ad94853385d2a3ec188d4a6066eb5b3c7dcc52c0a692

    • SHA512

      ad0a270a857b2165513bb0f2a0ee32c6d343149d1faaca0b735733d177af1c11cbe5ead694bf7e9a106017fb56023b779dfad4f6ceccc5b91fd3e9b890c187c5

    • SSDEEP

      12288:paIJZRxQe8CBNKJ/3ISJFiT32e6MJE+8MOUBXiPb:0ID8aB0F4Sjm2e5+jWiPb

    Score
    10/10
    gozi_ifsbbankerpersistencetrojan

    • Gozi, Gozi IFSB

      Gozi ISFB is a well-known and widely distributed banking trojan.

      bankertrojangozi_ifsb

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks