gozi

General

Target

57d3eb665f1e9e6a19f278baabd49e7b.bin
Size

9KB
Sample

231007-bz6v8agg3v
MD5

7757438e6f7cca0a4bb164801d88b3b3
SHA1

7fab6b5c30d33f3d5ec4d65712c65c53943ed1e5
SHA256

c148a90c12cc2c6664e074799c4a19ad28bdd2c47e3f0bf7c553dbecf89bf8fc
SHA512

7de0044b7140dbb5f3cd3daf11d046bf3809ca61ad520a0404cf4c41283ffcca9639d98d305aff9e05c22624b306837ae799bbff728c10672b231cee75009aa8
SSDEEP

192:Xk+GmCAiZHZUfMIenLHxYm4VhVwDF5jBokc4Rjiq2m2YgofO0IqGwV3J:XlGvUfMlLRZ4VhVwZ5jBEWjtwqv

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://communicalink.com/index.php

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

C2

mifrutty.com

Attributes

base_path
/jerry/
build
250260
exe_type
loader
extension
.bob
server_id
50

rsa_pubkey.plain

aes.plain

Extracted

Family

gozi

Botnet

5050

C2

http://igrovdow.com

Attributes

base_path
/pictures/
build
250260
exe_type
worker
extension
.bob
server_id
50

rsa_pubkey.plain

aes.plain

Targets

- Target
  
  4380de3cba18880ef72d2bc73ec84ee6f9f27b55d635a81ab8d40d488f59303d.hta
- Size
  
  22KB
- MD5
  
  57d3eb665f1e9e6a19f278baabd49e7b
- SHA1
  
  44566a9d716e6abd0304544dd88d245fea990882
- SHA256
  
  4380de3cba18880ef72d2bc73ec84ee6f9f27b55d635a81ab8d40d488f59303d
- SHA512
  
  30a0a3349aa0b815728abdb0c770d65354cdcf68ca939de4c175bdb285e3d664d7afdddc4be91bae170a65e4f808e6de7cc877fa36442f64f7b7db993e83851d
- SSDEEP
  
  384:rO6BO5aa8mOFhyS1q5H8qxAt4VFhmqmfW9PW6vN1v35Zh5LaBY5E6bqBdOfF:4zS0kPWVN5LbtcOfF
Score

10^/10

gozi 5050 banker isfb trojan
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Targets

Blocklisted process makes network request

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2