Overview

overview

10

Static

static

1

05234599.msi

windows7-x64

10

05234599.msi

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    05234599.msi

  • Size

    5.8MB

  • Sample

    230526-pd5b6afh4t

  • MD5

    82ff84cb9924f0855a894e75b5d3edb2

  • SHA1

    df89381239f8a8ececeb697a6a35a573203bac09

  • SHA256

    cd8393350f7cfc0762e09ee3b0a98002a1b9abf362caf5f210e717e1d4ebe53a

  • SHA512

    416db643cbfda60b26bb3eac8b6a94b148b506bc016d562bc51e085f765400c56412462b42e2e29dcc44fa621349781c1c225081804c528a0a7fd1822663597b

  • SSDEEP

    98304:ajJzMUpQ/2zKN5DmsQPKEvia5Zld9l4jH43ZnzgB1wLhQNHFRaFUDAQQHk8iQdvk:M5NzKNgsKKE6UZD9l4IZnzgLwLhQNHFd

Score
10/10
gozi1000bankerldr4trojan

Malware Config

Extracted

Family

gozi

Botnet

1000

C2

https://sumarno.top

Attributes
  • host_keep_time

    2

  • host_shift_time

    1

  • idle_time

    1

  • request_time

    10

aes.plain

Targets

    • Target

      05234599.msi

    • Size

      5.8MB

    • MD5

      82ff84cb9924f0855a894e75b5d3edb2

    • SHA1

      df89381239f8a8ececeb697a6a35a573203bac09

    • SHA256

      cd8393350f7cfc0762e09ee3b0a98002a1b9abf362caf5f210e717e1d4ebe53a

    • SHA512

      416db643cbfda60b26bb3eac8b6a94b148b506bc016d562bc51e085f765400c56412462b42e2e29dcc44fa621349781c1c225081804c528a0a7fd1822663597b

    • SSDEEP

      98304:ajJzMUpQ/2zKN5DmsQPKEvia5Zld9l4jH43ZnzgB1wLhQNHFRaFUDAQQHk8iQdvk:M5NzKNgsKKE6UZD9l4IZnzgLwLhQNHFd

    Score
    10/10
    gozi1000bankerldr4trojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks