gozi | 8932ac8878c5eafb68986b8bab98e50f6f2a6e7ce49c28ce682708f25656c9cc | Triage

Sharing

General

Target

681b65ba5f4ca3b98a08da2c7ae9da0a
Size

643KB
Sample

231226-mq2qpahaa5
MD5

681b65ba5f4ca3b98a08da2c7ae9da0a
SHA1

00fc38ab30e4c52ebb0e2c3cdddb99927052b1b0
SHA256

8932ac8878c5eafb68986b8bab98e50f6f2a6e7ce49c28ce682708f25656c9cc
SHA512

8fee3513eaf2d7f3065ad4495e0f58f5b623579dca0601ddeee2075ba6aeea98ee6717ebe5e11e046eb31de7262843bc75b1afb895f762511a6f88af24d1d3de
SSDEEP

12288:HMUpikM1ABVY4lsBnllWzwazxRvwY9QKC71L715+PoR5nFIlW2i:K4Y4lglQzwyxRvwMSJLT5FIV

Score

10^/10

gozi 1500 banker isfb trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

1500

C2

gtr.antoinfer.com

app.bighomegl.at

Attributes

build
250211
exe_type
loader
server_id
580

rsa_pubkey.plain

aes.plain

Targets

- Target
  
  681b65ba5f4ca3b98a08da2c7ae9da0a
- Size
  
  643KB
- MD5
  
  681b65ba5f4ca3b98a08da2c7ae9da0a
- SHA1
  
  00fc38ab30e4c52ebb0e2c3cdddb99927052b1b0
- SHA256
  
  8932ac8878c5eafb68986b8bab98e50f6f2a6e7ce49c28ce682708f25656c9cc
- SHA512
  
  8fee3513eaf2d7f3065ad4495e0f58f5b623579dca0601ddeee2075ba6aeea98ee6717ebe5e11e046eb31de7262843bc75b1afb895f762511a6f88af24d1d3de
- SSDEEP
  
  12288:HMUpikM1ABVY4lsBnllWzwazxRvwY9QKC71L715+PoR5nFIlW2i:K4Y4lglQzwyxRvwMSJLT5FIV
Score

10^/10

gozi 1500 banker isfb trojan
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

gozi1500bankerisfbtrojan

behavioral2

gozi1500bankerisfbtrojan