Overview

overview

10

Static

static

1

Agenzia_En...te.url

windows7-x64

1

Agenzia_En...te.url

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Agenzia_Entrate.zip

  • Size

    514B

  • Sample

    230309-kstfzsbf22

  • MD5

    4b5b347c0628618f3f49e3bbf8a0ce5f

  • SHA1

    2af93a9dd6d5fa5fa4560e7cb548df749f48e71c

  • SHA256

    1f233fdb94239fa884321a91d14342c1a66e64ce02dc64378cb7c53669d5ea28

  • SHA512

    6503d08e246c0b2908e0932288fe433fcd42b1f324bfd557bce7288d6539f76c6149bc2b9a009581032f3c8ea8ed783ac0043be12c65402fe2271156587bbcd9

Score
10/10
gozi7712bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7712

C2

checklist.skype.com

62.173.141.36

31.41.44.85

193.233.175.98

46.8.210.110

89.116.227.49
Attributes
  • base_path

    /drew/

  • build

    250255

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Targets

    • Target

      Agenzia_Entrate/Agenzia_Entrate.url

    • Size

      191B

    • MD5

      c57ce09111a84d1110b24a8505ff5804

    • SHA1

      9fd1e2577f10a24c2678803e073d35e41b551eb2

    • SHA256

      257413c17f63500a76f9d0216a8dee283021299a61dc0539e6e870fd5d78177b

    • SHA512

      71cf1e5d069a75be84cfcaf82479fb037e75055c05e94ad212453769288b1e3b194156fad802619b0850c9e9abb3c045600779de234b8b51505b1a54f46b7c84

    Score
    10/10
    gozi7712bankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks