Overview

overview

10

Static

static

10

e9412c9aa9...4d.exe

windows7-x64

10

e9412c9aa9...4d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e9412c9aa9beed360ed8dd11568e57651db7a3ab87498932e4b7bfceb28d5b4d

  • Size

    2.7MB

  • Sample

    221026-1wc66shchq

  • MD5

    4a0ccd776503d64c271c77cc84c1645f

  • SHA1

    1c017847937ffae8260728d0e0674af6b7b3c350

  • SHA256

    e9412c9aa9beed360ed8dd11568e57651db7a3ab87498932e4b7bfceb28d5b4d

  • SHA512

    4897b866ce5e212e6a2ada94b4a5e9ac5e0129166ecda35fe106fd8000fdbff5fe87828b30b2d9b2f132e2f038bf09e3c1ca8070f1fbd0d4e115d3e5c8a0fe24

  • SSDEEP

    49152:KOZyfrFDnxWwUbCkLMh5LYGwBmezZUpjjhzf29v/:dZyfrhny+h5LYGwXmpjVzf2B

Score
10/10
gozi_ifsbbankerbootkitpersistencetrojan

Malware Config

Targets

    • Target

      e9412c9aa9beed360ed8dd11568e57651db7a3ab87498932e4b7bfceb28d5b4d

    • Size

      2.7MB

    • MD5

      4a0ccd776503d64c271c77cc84c1645f

    • SHA1

      1c017847937ffae8260728d0e0674af6b7b3c350

    • SHA256

      e9412c9aa9beed360ed8dd11568e57651db7a3ab87498932e4b7bfceb28d5b4d

    • SHA512

      4897b866ce5e212e6a2ada94b4a5e9ac5e0129166ecda35fe106fd8000fdbff5fe87828b30b2d9b2f132e2f038bf09e3c1ca8070f1fbd0d4e115d3e5c8a0fe24

    • SSDEEP

      49152:KOZyfrFDnxWwUbCkLMh5LYGwBmezZUpjjhzf29v/:dZyfrhny+h5LYGwXmpjVzf2B

    Score
    10/10
    gozi_ifsbbankerbootkitpersistencetrojan

    • Gozi, Gozi IFSB

      Gozi ISFB is a well-known and widely distributed banking trojan.

      bankertrojangozi_ifsb

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks