gozi

General

Target

5633a46c25aced4b07728fd437b92c5e9102eabaa134ac584e2aae2e0adce587_JC.exe
Size

267KB
Sample

231011-kenzcabd7z
MD5

5a84945991cf24c957cf67fd414c9f9a
SHA1

06206df47fd0805d616f31b5e56daa6378409e72
SHA256

5633a46c25aced4b07728fd437b92c5e9102eabaa134ac584e2aae2e0adce587
SHA512

307f16d760c0adbeb829705e6db167c460c7d048da56049a8240c6cf6de69c2e6f41fcb9cca7c2e2ee03b8b5cbe8132f346fc3626c39e7f4de6c6d0cbfce2ed2
SSDEEP

6144:ZWO3FffE31kwsQODpAkVyakH7bWMxNTf:EOFf8lDsQsVyaOP5

Score

10^/10

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

C2

netsecurez.com

whofoxy.com

mimemoa.com

ntcgo.com

Attributes

base_path
/jerry/
build
250260
exe_type
loader
extension
.bob
server_id
50

rsa_pubkey.plain

aes.plain

Extracted

Family

gozi

Botnet

5050

C2

fotexion.com

Attributes

base_path
/pictures/
build
250260
exe_type
worker
extension
.bob
server_id
50

rsa_pubkey.plain

aes.plain

Targets

- Target
  
  5633a46c25aced4b07728fd437b92c5e9102eabaa134ac584e2aae2e0adce587_JC.exe
- Size
  
  267KB
- MD5
  
  5a84945991cf24c957cf67fd414c9f9a
- SHA1
  
  06206df47fd0805d616f31b5e56daa6378409e72
- SHA256
  
  5633a46c25aced4b07728fd437b92c5e9102eabaa134ac584e2aae2e0adce587
- SHA512
  
  307f16d760c0adbeb829705e6db167c460c7d048da56049a8240c6cf6de69c2e6f41fcb9cca7c2e2ee03b8b5cbe8132f346fc3626c39e7f4de6c6d0cbfce2ed2
- SSDEEP
  
  6144:ZWO3FffE31kwsQODpAkVyakH7bWMxNTf:EOFf8lDsQsVyaOP5
Score

10^/10

gozi 5050 banker isfb trojan
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
- Deletes itself
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Targets

Deletes itself

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2