gozi | f41d351cba690cf05e4b5e5597b71697eb2e9125b656927aaf93edba25fbc8cd | Triage

Sharing

General

Target

8390c9aff9b8f652c36252270d51fb30
Size

529KB
Sample

240131-f6kc1scdg2
MD5

8390c9aff9b8f652c36252270d51fb30
SHA1

919ce33025c1901a2088b77c8543eb729fccf17a
SHA256

f41d351cba690cf05e4b5e5597b71697eb2e9125b656927aaf93edba25fbc8cd
SHA512

c1d5326f0a40d673aa1647842915d6eab70a34383238387bc2b7b4027d38d6d07676b71ff0a7e3d71d884c080f315714792459aaf49f90c3970404f032fe1a19
SSDEEP

12288:ntCE7dSeqW+MNurWAFKlJejMSH6nimDC2t:bdSeSvrWAFK7ejNa/e0

Score

10^/10

gozi 1500 banker isfb trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

1500

C2

f1.bablefiler.at

f22.avanoruk.com

Attributes

build
250211
exe_type
loader
server_id
580

rsa_pubkey.plain

aes.plain

Targets

- Target
  
  8390c9aff9b8f652c36252270d51fb30
- Size
  
  529KB
- MD5
  
  8390c9aff9b8f652c36252270d51fb30
- SHA1
  
  919ce33025c1901a2088b77c8543eb729fccf17a
- SHA256
  
  f41d351cba690cf05e4b5e5597b71697eb2e9125b656927aaf93edba25fbc8cd
- SHA512
  
  c1d5326f0a40d673aa1647842915d6eab70a34383238387bc2b7b4027d38d6d07676b71ff0a7e3d71d884c080f315714792459aaf49f90c3970404f032fe1a19
- SSDEEP
  
  12288:ntCE7dSeqW+MNurWAFKlJejMSH6nimDC2t:bdSeSvrWAFK7ejNa/e0
Score

10^/10

gozi 1500 banker isfb trojan
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

gozi1500bankerisfbtrojan

behavioral2

gozi1500bankerisfbtrojan