General
- Target FM85.zip
- Size 335KB
- Sample221215-vs55wsfh2s
- SHA256 54aa0629030dd73c87c439e09e0dda942775da54b61ffde9844ca2bd2cfb07a7
Score
10/10
Malware Config
Extracted
Family
-
gozi
Extracted
Family
-
gozi
Botnet
-
50000
C2
-
http://confisg.edges.skype.com
-
http://108.61.165.145
-
http://37.120.222.23
-
http://194.76.224.234
-
http://176.10.111.47
Attributes
-
base_path
/grome/
-
build
250249
-
exe_type
loader
-
extension
.chk
-
server_id
50
rsa_pubkey.plain
aes.plain
Extracted
Family
-
gozi
Botnet
-
50000
C2
-
https://confisg.edges.skype.com
-
http://108.61.165.145
-
http://37.120.222.23
-
http://79.132.128.146
-
http://176.10.119.229
-
http://176.10.111.45
-
http://79.132.128.151
-
http://176.10.111.47
Attributes
-
base_path
/grome/
-
build
250249
-
exe_type
worker
-
extension
.chk
-
server_id
50
rsa_pubkey.plain
aes.plain
Targets
-
- Target VV.lnk
- Size 1KB
- SHA256 9c6ce72957b412592a5c8d7d0324a53f2a7a77ca94773549494aecf18c83d050
Score10/10-
Gozi
Gozi is a well-known and widely distributed banking trojan.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-
- Target staunch/enfeebles.cmd
- Size 275B
- SHA256 0e6761acc6a4da6c360730da8c1a3a03e782058c51bb95e47946f52a7524bada
Score1/10 -
- Target staunch/fizzy.sql
- Size 580KB
- SHA256 7ad0db9da1c28e6d12826b846ee3c82bda649e00d717cb2c4aefeaed56ea48ce
Score10/10-
Gozi
Gozi is a well-known and widely distributed banking trojan.
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-
- Target staunch/registrants.cmd
- Size 203B
- SHA256 61794da96a047bf99eb8ef51896e872d79d77a4760c056ff5ea9e749a263893d
Score1/10