Overview

overview

10

Static

static

0e61ecd0aa...e2.exe

windows7-x64

10

0e61ecd0aa...e2.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0e61ecd0aad87a72d36bc10288303292859a800d2237ac9c32755d9e455e87e2

  • Size

    221KB

  • Sample

    221026-3w3g6saah8

  • MD5

    a26ff2a7664aaa03d41a591fc71d2221

  • SHA1

    a7344edd33d4bcd538fdba240c2996417a0d63b8

  • SHA256

    0e61ecd0aad87a72d36bc10288303292859a800d2237ac9c32755d9e455e87e2

  • SHA512

    dcf52e588fa84f3e32f76bd981d74756ef2899212a750d30c61eaec5480f32c4b11b42d35b4becb9db210f2974ace32ae9d4b5e46004164eaee1017124fb928e

  • SSDEEP

    6144:VUB6frB+kTPBKVhkXgAcSifvJMOLvZTyGDZu:OBqrB+kTJO/OifnRD

Score
10/10
gozi_ifsbbankerpersistencetrojan

Malware Config

Targets

    • Target

      0e61ecd0aad87a72d36bc10288303292859a800d2237ac9c32755d9e455e87e2

    • Size

      221KB

    • MD5

      a26ff2a7664aaa03d41a591fc71d2221

    • SHA1

      a7344edd33d4bcd538fdba240c2996417a0d63b8

    • SHA256

      0e61ecd0aad87a72d36bc10288303292859a800d2237ac9c32755d9e455e87e2

    • SHA512

      dcf52e588fa84f3e32f76bd981d74756ef2899212a750d30c61eaec5480f32c4b11b42d35b4becb9db210f2974ace32ae9d4b5e46004164eaee1017124fb928e

    • SSDEEP

      6144:VUB6frB+kTPBKVhkXgAcSifvJMOLvZTyGDZu:OBqrB+kTJO/OifnRD

    Score
    10/10
    gozi_ifsbbankerpersistencetrojan

    • Gozi, Gozi IFSB

      Gozi ISFB is a well-known and widely distributed banking trojan.

      bankertrojangozi_ifsb

    • Modifies Installed Components in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

5
T1082

Peripheral Device Discovery

2
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks