gozi | 71ead9f51c149c931503516271a1112a86d83921a8a17bec322e27c4298f4dc6 | Triage

Submit
Reports

Overview

overview

Static

static

71ead9f51c...c6.exe

windows7-x64

71ead9f51c...c6.exe

windows10-2004-x64

Sharing

General

Target

71ead9f51c149c931503516271a1112a86d83921a8a17bec322e27c4298f4dc6
Size

163KB
Sample

240515-3gnepshf5x
MD5

2ef6f2ab3dda1ecab6f96e20c8ea47f2
SHA1

2dd3dc91a6b1fc70065a965f8164ee0413dea487
SHA256

71ead9f51c149c931503516271a1112a86d83921a8a17bec322e27c4298f4dc6
SHA512

76147da5f3eb5c5ebe408011e89c6cae709f8df2cb502d25aa1f2de7fac04c9cd64369ac155f6b932248d123bc018a2dc42bb8b9f91f45c713e0387d777c1f09
SSDEEP

1536:PiML+CBIuD7bJmw2vF9b+Pom4enxtasJzlProNVU4qNVUrk/9QbfBr+7GwKrPAsf:KMicD/JcvF9W+tsJzltOrWKDBr+yJb

Score

10^/10

gozi banker isfb persistence trojan

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

71ead9f51c149c931503516271a1112a86d83921a8a17bec322e27c4298f4dc6.exe

Resource

win7-20240221-en

gozi banker isfb persistence trojan

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

71ead9f51c149c931503516271a1112a86d83921a8a17bec322e27c4298f4dc6.exe

Resource

win10v2004-20240426-en

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Extracted

Family

gozi

Targets

- Target
  
  71ead9f51c149c931503516271a1112a86d83921a8a17bec322e27c4298f4dc6
- Size
  
  163KB
- MD5
  
  2ef6f2ab3dda1ecab6f96e20c8ea47f2
- SHA1
  
  2dd3dc91a6b1fc70065a965f8164ee0413dea487
- SHA256
  
  71ead9f51c149c931503516271a1112a86d83921a8a17bec322e27c4298f4dc6
- SHA512
  
  76147da5f3eb5c5ebe408011e89c6cae709f8df2cb502d25aa1f2de7fac04c9cd64369ac155f6b932248d123bc018a2dc42bb8b9f91f45c713e0387d777c1f09
- SSDEEP
  
  1536:PiML+CBIuD7bJmw2vF9b+Pom4enxtasJzlProNVU4qNVUrk/9QbfBr+7GwKrPAsf:KMicD/JcvF9W+tsJzltOrWKDBr+yJb
Score

10^/10

gozi banker isfb persistence trojan
- Adds autorun key to be loaded by Explorer.exe on startup
  persistence
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
- Detects executables built or packed with MPress PE compressor
- UPX dump on OEP (original entry point)
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozibankerisfbpersistencetrojan

behavioral2

© 2018-2024

Terms | Privacy