Overview

overview

10

Static

static

fcf0794f4c...9a.exe

windows7-x64

10

fcf0794f4c...9a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fcf0794f4c7c678763286e84d32d1451199e1fd1695fe21867955fa04dcae89a

  • Size

    288KB

  • Sample

    221127-rwwh3sdh89

  • MD5

    0b6df2838e0eb797fe43700fde1a13d2

  • SHA1

    83dc0a5bb4c68c7146df0f8fe59bc958888304bd

  • SHA256

    fcf0794f4c7c678763286e84d32d1451199e1fd1695fe21867955fa04dcae89a

  • SHA512

    97854e83ea45d8e31dda9c8f0685281d1af9e73f41b2df170b781075fd106143340d16fee24dfb8453b3e187a2b95b0b9f0dad5a08f11c7e4602822821503739

  • SSDEEP

    6144:wUk5hN+hPNHAniFBX0OCfRUTHsZ6T44fYXzYfOJnrLi4U+Ep3:wUk5vwHaglpTHsm4qYXcWJnrLi4U+Ep3

Score
10/10
gozi2000bankerisfbpersistencetrojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

2000

C2

tandem88.ru

janetly741.ru

juano229.ru

bumbo998.ru

chiko99.ru
Attributes
  • build

    212507

  • exe_type

    worker

  • server_id

    93

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      fcf0794f4c7c678763286e84d32d1451199e1fd1695fe21867955fa04dcae89a

    • Size

      288KB

    • MD5

      0b6df2838e0eb797fe43700fde1a13d2

    • SHA1

      83dc0a5bb4c68c7146df0f8fe59bc958888304bd

    • SHA256

      fcf0794f4c7c678763286e84d32d1451199e1fd1695fe21867955fa04dcae89a

    • SHA512

      97854e83ea45d8e31dda9c8f0685281d1af9e73f41b2df170b781075fd106143340d16fee24dfb8453b3e187a2b95b0b9f0dad5a08f11c7e4602822821503739

    • SSDEEP

      6144:wUk5hN+hPNHAniFBX0OCfRUTHsZ6T44fYXzYfOJnrLi4U+Ep3:wUk5vwHaglpTHsm4qYXcWJnrLi4U+Ep3

    Score
    10/10
    gozi2000bankerisfbpersistencetrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Modifies Installed Components in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

5
T1082

Peripheral Device Discovery

2
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks