gozi

General

Target

inform.zip
Size

159KB
Sample

231012-rezjeadc9y
MD5

b0b8eecb2fff7a0e295c02cd846b5bbf
SHA1

d480450b9eca19d49f9df831b4d6c92ec4c7e0e9
SHA256

f031cac9dd28b035c7027c23d79c88382d8c7b048c736f8ac7e3c9ec364b5e92
SHA512

7a59067f52e27b51d5ac21fc23914a5dea755d9273fb081a6427a46d32fae60ab6b19afd8aaa51b585a025629097bb4ef395bccaf6026de385f32de8d8431c32
SSDEEP

3072:SQ0nEQH0AkecLGrcchh3s47XlXfT+Fgjl/P5pcAyVV3wsOmtEQsh41TBKF7As01m:X0nEBA5r3h3LX9r+qNBazgFmWQsudBcn

Score

10^/10

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

C2

fotexion.com

Attributes

base_path
/jerry/
build
250260
exe_type
loader
extension
.bob
server_id
50

rsa_pubkey.plain

aes.plain

Extracted

Family

gozi

Botnet

5050

C2

fotexion.com

Attributes

base_path
/pictures/
build
250260
exe_type
worker
extension
.bob
server_id
50

rsa_pubkey.plain

aes.plain

Targets

- Target
  
  inform.cpl
- Size
  
  206KB
- MD5
  
  72e2a5c797954e895a41be5b20f867b2
- SHA1
  
  419aacfb3ccea9b08277bcc9405054fa4238a597
- SHA256
  
  858d867cc62c0bf13b16ccdb9f6cd6022d61fc2ab98a7db60806a35c7da9b2e0
- SHA512
  
  77be53cf579f69ee728fafbe93568b8d4c462490ba3fe053db367798508abb0d7a838731d17e465f0a29b982eb49e1227d94c971823e1d375b2b761887e107b3
- SSDEEP
  
  6144:sMmIE7vr+qWNGzfXDanCU60rPP+vJsWKq12Jy:o/7DrQGzfXDeCU6cevKWXwy
Score

10^/10

gozi 5050 banker isfb trojan
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Targets

Blocklisted process makes network request

Checks computer location settings

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2