gozi

General

Target

client.exe
Size

296KB
Sample

231003-v3s83sgb39
MD5

f5830dc3fe80761eb82a0754b1697e6b
SHA1

9f25e979cb2de3857278645b60c4afa37d0e6702
SHA256

ddce7321ecf07394badc64ef8b5fc6000b56c517f7ed6dc1506e4c6c8b4b29a6
SHA512

8fc4bf848205a3d28dc457e0e09f0831336be36a0824e93818a85207a8a8a63597815918f53dd472cf99ec1f08f8a2aa7cb1a5b43cf7c9782de69899620298fa
SSDEEP

3072:YaL9FpSv0N0aIlzHMyXxpJD4xXvw1h+XKwY1a/I6RMxY:tpF0vW0aIlf+/w1hIr2aI6G

Score

10^/10

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

C2

185.247.184.139

62.72.33.155

incontroler.com

Attributes

base_path
/jerry/
build
250260
exe_type
loader
extension
.bob
server_id
50

rsa_pubkey.plain

aes.plain

Extracted

Family

gozi

Botnet

5050

C2

expirew.com

whofos.com

onlinepoints.online

onlinepoints.top

Attributes

base_path
/pictures/
build
250260
exe_type
worker
extension
.bob
server_id
50

rsa_pubkey.plain

aes.plain

Targets

- Target
  
  client.exe
- Size
  
  296KB
- MD5
  
  f5830dc3fe80761eb82a0754b1697e6b
- SHA1
  
  9f25e979cb2de3857278645b60c4afa37d0e6702
- SHA256
  
  ddce7321ecf07394badc64ef8b5fc6000b56c517f7ed6dc1506e4c6c8b4b29a6
- SHA512
  
  8fc4bf848205a3d28dc457e0e09f0831336be36a0824e93818a85207a8a8a63597815918f53dd472cf99ec1f08f8a2aa7cb1a5b43cf7c9782de69899620298fa
- SSDEEP
  
  3072:YaL9FpSv0N0aIlzHMyXxpJD4xXvw1h+XKwY1a/I6RMxY:tpF0vW0aIlf+/w1hIr2aI6G
Score

10^/10

gozi 5050 banker isfb trojan
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
- Deletes itself
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Targets

Deletes itself

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2