gozi | fb3009e2deadbc2d6760489395bafba79aab3a3cfb41be06181d51bfe864d09b | Triage

Sharing

General

Target

d667b1620c679459b264492bfac2703b
Size

551KB
Sample

240319-sdenaafe3x
MD5

d667b1620c679459b264492bfac2703b
SHA1

2eea0c6336defa9de132815607490035e47ea734
SHA256

fb3009e2deadbc2d6760489395bafba79aab3a3cfb41be06181d51bfe864d09b
SHA512

bac6f9956237df1a1fd2554e1210365ce1521a0cd89601b0228cebcb94c3ef6e454885079fa5f0e9383a63e378fe86490c935b1e99901c9500081f89549f3d4e
SSDEEP

12288:4dsRFeVssCM5gMrj/LMMtBV0P6Fm92E89xE6FWkogdBtXcPZMfvG1EqYDWDt42O/:usRIfhAadeFoQqffC

Score

10^/10

gozi 1500 banker isfb trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

1500

C2

f1.bablefiler.at

f22.avanoruk.com

Attributes

build
250211
exe_type
loader
server_id
580

rsa_pubkey.plain

aes.plain

Targets

- Target
  
  d667b1620c679459b264492bfac2703b
- Size
  
  551KB
- MD5
  
  d667b1620c679459b264492bfac2703b
- SHA1
  
  2eea0c6336defa9de132815607490035e47ea734
- SHA256
  
  fb3009e2deadbc2d6760489395bafba79aab3a3cfb41be06181d51bfe864d09b
- SHA512
  
  bac6f9956237df1a1fd2554e1210365ce1521a0cd89601b0228cebcb94c3ef6e454885079fa5f0e9383a63e378fe86490c935b1e99901c9500081f89549f3d4e
- SSDEEP
  
  12288:4dsRFeVssCM5gMrj/LMMtBV0P6Fm92E89xE6FWkogdBtXcPZMfvG1EqYDWDt42O/:usRIfhAadeFoQqffC
Score

10^/10

gozi 1500 banker isfb trojan
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

gozi1500bankerisfbtrojan

behavioral2

gozi1500bankerisfbtrojan