gozi_ifsb | 231cabbbdbe83301dcb99968347e82973ced1ddd679c54cbb676768cd1ad4121

Analysis

max time kernel
505s
max time network
508s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-10-2022 00:07

Target

514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54_unpacked_x64.dll
Size

329KB
MD5

bfcb099d6757db3d1d954e5cc75f5944
SHA1

7a2466e49ad583ff1acabe54a115d2b5309ac270
SHA256

231cabbbdbe83301dcb99968347e82973ced1ddd679c54cbb676768cd1ad4121
SHA512

fd824557a8632782f33a8ea6867d2b3bcc8443c4bd991e898f56a5b5e9ba68f45daac7228bec65558389e852b2b0744011623fae9cf18ebfb8dfdba02bbd7aab
SSDEEP

6144:QofgAud4CTOOtg6Tq2CjsCnEWc57hpDXroE1A24:Qodud4WOOy6UsCrM/DXroEP4

Score

10^/10

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54_unpacked_x64.dll,#1
1⤵
PID:4248