gozi

General

Target
file.exe
Size 245KB
Sample221229-d3l2bsfc9y
SHA256 241344bd5a7cf25d2349bde6a2e4fc11a9d826583d1185f293bcf24abd071ae4
MD5 5dacb211252a6d2a91d54f97c6a97a5d
SHA1 acfa5511d55602c8a69770a534d1c8fbd44e3bfa
SHA512 228f9fff4120bc5ab33d7328ae12063d4f243a2489cd36fcb0984be23133484c4dd3a79652145f7df94667ca920e3b0e875ea46f12204a49df97ed91fc64ab91
SSDEEP 3072:igSjL5nw5nlarRuNa9TLT9RbHbO69rEKdf3EPeoAix/wDDtdmdhmUXG83H:CjLBHRmaPRzCqrEKdf0PpZiDtmmUXT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

22500

C2

confisg.edge.skype.com
http://
s28bxcw.xyz
config.edgse.skype.com
http://89.43.107.7

Attributes

base_path
/recycle/
build
250249
exe_type
loader
extension
.alo
server_id
50

rsa_pubkey.plain

aes.plain

Extracted

Family

gozi

Botnet

22500

C2

confisg.edge.skype.com
http://5icvzwz.xyz
http://185.14.45.80

Attributes

base_path
/recycle/
build
250249
exe_type
worker
extension
.alo
server_id
50

rsa_pubkey.plain

aes.plain

Targets

- Target
  file.exe
- Size 245KB
- SHA256 241344bd5a7cf25d2349bde6a2e4fc11a9d826583d1185f293bcf24abd071ae4
- MD5 5dacb211252a6d2a91d54f97c6a97a5d
- SHA1 acfa5511d55602c8a69770a534d1c8fbd44e3bfa
- SHA512 228f9fff4120bc5ab33d7328ae12063d4f243a2489cd36fcb0984be23133484c4dd3a79652145f7df94667ca920e3b0e875ea46f12204a49df97ed91fc64ab91
- SSDEEP 3072:igSjL5nw5nlarRuNa9TLT9RbHbO69rEKdf3EPeoAix/wDDtdmdhmUXG83H:CjLBHRmaPRzCqrEKdf0PpZiDtmmUXT
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

smokeloader backdoor trojan gozi 22500 banker isfb
- Detects Smokeloader packer
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

1

T1018

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Targets

Detects Smokeloader packer

SmokeLoader

Checks computer location settings

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2