gozi

General

Target

client.exe
Size

295KB
Sample

231003-pea5psae6y
MD5

ed017c0f334b6d10ac5aca77fe7f9a2a
SHA1

de7a838cbf418f5c093e5bed00254c4c68b82fa7
SHA256

9f710a0fc0cadbf3378c06ca4fefa2486bdf04646201f9efec7cd5a4c97634b4
SHA512

e7210ef6cfb8b9cad8078b8bdc4331eba04c9b7bd87b1aadce8c84560035fe4725161dceaca03608f10f7e02de7120c6dbf345c0ac69c72d5613e85080f58316
SSDEEP

3072:Az6N1tmvikka83g9IGkpt4fMlw5mlg9eidid74+VONrRrCS:bN1cvBka83g9PkUf55B++1r

Score

10^/10

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

C2

185.247.184.139

62.72.33.155

incontroler.com

Attributes

base_path
/jerry/
build
250260
exe_type
loader
extension
.bob
server_id
50

rsa_pubkey.plain

aes.plain

Extracted

Family

gozi

Botnet

5050

C2

expirew.com

whofos.com

onlinepoints.online

onlinepoints.top

Attributes

base_path
/pictures/
build
250260
exe_type
worker
extension
.bob
server_id
50

rsa_pubkey.plain

aes.plain

Targets

- Target
  
  client.exe
- Size
  
  295KB
- MD5
  
  ed017c0f334b6d10ac5aca77fe7f9a2a
- SHA1
  
  de7a838cbf418f5c093e5bed00254c4c68b82fa7
- SHA256
  
  9f710a0fc0cadbf3378c06ca4fefa2486bdf04646201f9efec7cd5a4c97634b4
- SHA512
  
  e7210ef6cfb8b9cad8078b8bdc4331eba04c9b7bd87b1aadce8c84560035fe4725161dceaca03608f10f7e02de7120c6dbf345c0ac69c72d5613e85080f58316
- SSDEEP
  
  3072:Az6N1tmvikka83g9IGkpt4fMlw5mlg9eidid74+VONrRrCS:bN1cvBka83g9PkUf55B++1r
Score

10^/10

gozi 5050 banker isfb trojan
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
- Deletes itself
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Targets

Deletes itself

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2