gozi

General

Target
file.exe
Size 244KB
Sample221229-c1apvafc3y
SHA256 caee73c51dcdcfc4e3bc770746d27d820727347328524897f152b60490060177
MD5 352b982cc6a77455da31a5af4fc62ed3
SHA1 02bc46b4ee32c481208fb90eab23aa47c5fce3fe
SHA512 b4188e71bd7779d32762e51a65718e18f1f74511e8e8bc024485e86756cc277aa5d4afc7c039ebdd108bdf38a94d8abe451ca09d65a7c464f190cd54d0cd4f39
SSDEEP 3072:YkUVEpLps5DDl422bnWvfJQsJueFcXAVB3dwDDtdmdhmUXG83H:SVEpLpK72bifVBdiDtmmUXT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

22500

C2

confisg.edge.skype.com
http://
s28bxcw.xyz
config.edgse.skype.com
http://89.43.107.7

Attributes

base_path
/recycle/
build
250249
exe_type
loader
extension
.alo
server_id
50

rsa_pubkey.plain

aes.plain

Extracted

Family

gozi

Botnet

22500

C2

confisg.edge.skype.com
http://5icvzwz.xyz
http://185.14.45.80

Attributes

base_path
/recycle/
build
250249
exe_type
worker
extension
.alo
server_id
50

rsa_pubkey.plain

aes.plain

Targets

- Target
  file.exe
- Size 244KB
- SHA256 caee73c51dcdcfc4e3bc770746d27d820727347328524897f152b60490060177
- MD5 352b982cc6a77455da31a5af4fc62ed3
- SHA1 02bc46b4ee32c481208fb90eab23aa47c5fce3fe
- SHA512 b4188e71bd7779d32762e51a65718e18f1f74511e8e8bc024485e86756cc277aa5d4afc7c039ebdd108bdf38a94d8abe451ca09d65a7c464f190cd54d0cd4f39
- SSDEEP 3072:YkUVEpLps5DDl422bnWvfJQsJueFcXAVB3dwDDtdmdhmUXG83H:SVEpLpK72bifVBdiDtmmUXT
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

smokeloader backdoor trojan gozi 22500 banker isfb
- Detects Smokeloader packer
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

1

T1018

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Targets

Detects Smokeloader packer

SmokeLoader

Checks computer location settings

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2