gozi | 07c4de5228d721b6ecd076e4fea4a8f1bc55ecc65e7f76e5aed8da390207db7b | Triage

Sharing

General

Target

fc6e37e0aed3ddf819bc3db52c3894d0_JaffaCakes118
Size

476KB
Sample

240420-lblkgsdd35
MD5

fc6e37e0aed3ddf819bc3db52c3894d0
SHA1

422ee70aa729bbc279e39a1dbd4329585d5dee90
SHA256

07c4de5228d721b6ecd076e4fea4a8f1bc55ecc65e7f76e5aed8da390207db7b
SHA512

93c4b86d8fe124a2926f8f1fa84e2bbb96aa41972956e24cc97ed3015044577d179ec9715b8343694712c400aeb30842ad678b5f854081c7d6afbb29c9535bb4
SSDEEP

12288:SWOHbRDDziohgDTw2ZLuFeCshv6Fsgg+:SWOHdD3hmTwKn3hvkg

Score

10^/10

gozi 1500 banker isfb trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

1500

C2

f1.bablefiler.at

f22.avanoruk.com

Attributes

build
250211
exe_type
loader
server_id
580

rsa_pubkey.plain

aes.plain

Targets

- Target
  
  fc6e37e0aed3ddf819bc3db52c3894d0_JaffaCakes118
- Size
  
  476KB
- MD5
  
  fc6e37e0aed3ddf819bc3db52c3894d0
- SHA1
  
  422ee70aa729bbc279e39a1dbd4329585d5dee90
- SHA256
  
  07c4de5228d721b6ecd076e4fea4a8f1bc55ecc65e7f76e5aed8da390207db7b
- SHA512
  
  93c4b86d8fe124a2926f8f1fa84e2bbb96aa41972956e24cc97ed3015044577d179ec9715b8343694712c400aeb30842ad678b5f854081c7d6afbb29c9535bb4
- SSDEEP
  
  12288:SWOHbRDDziohgDTw2ZLuFeCshv6Fsgg+:SWOHdD3hmTwKn3hvkg
Score

10^/10

gozi 1500 banker isfb trojan
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

gozi1500bankerisfbtrojan

behavioral2

gozi1500bankerisfbtrojan