gozi_ifsb | e9412c9aa9beed360ed8dd11568e57651db7a3ab87498932e4b7bfceb28d5b4d | Triage

Sharing

General

Target

e9412c9aa9beed360ed8dd11568e57651db7a3ab87498932e4b7bfceb28d5b4d
Size

2.7MB
Sample

221026-1wc66shchq
MD5

4a0ccd776503d64c271c77cc84c1645f
SHA1

1c017847937ffae8260728d0e0674af6b7b3c350
SHA256

e9412c9aa9beed360ed8dd11568e57651db7a3ab87498932e4b7bfceb28d5b4d
SHA512

4897b866ce5e212e6a2ada94b4a5e9ac5e0129166ecda35fe106fd8000fdbff5fe87828b30b2d9b2f132e2f038bf09e3c1ca8070f1fbd0d4e115d3e5c8a0fe24
SSDEEP

49152:KOZyfrFDnxWwUbCkLMh5LYGwBmezZUpjjhzf29v/:dZyfrhny+h5LYGwXmpjVzf2B

Score

10^/10

gozi_ifsb banker bootkit persistence trojan

Malware Config

Targets

- Target
  
  e9412c9aa9beed360ed8dd11568e57651db7a3ab87498932e4b7bfceb28d5b4d
- Size
  
  2.7MB
- MD5
  
  4a0ccd776503d64c271c77cc84c1645f
- SHA1
  
  1c017847937ffae8260728d0e0674af6b7b3c350
- SHA256
  
  e9412c9aa9beed360ed8dd11568e57651db7a3ab87498932e4b7bfceb28d5b4d
- SHA512
  
  4897b866ce5e212e6a2ada94b4a5e9ac5e0129166ecda35fe106fd8000fdbff5fe87828b30b2d9b2f132e2f038bf09e3c1ca8070f1fbd0d4e115d3e5c8a0fe24
- SSDEEP
  
  49152:KOZyfrFDnxWwUbCkLMh5LYGwBmezZUpjjhzf29v/:dZyfrhny+h5LYGwXmpjVzf2B
Score

10^/10

gozi_ifsb banker bootkit persistence trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

gozi_ifsbbankerbootkitpersistencetrojan

behavioral2

gozi_ifsbbankerbootkitpersistencetrojan