gozi | b2ff192125b2fc6af2ae615e0b93633786945ce9111902fda29d8fceee2d76d7 | Triage

Submit
Reports

Overview

overview

Static

static

b2ff192125...d7.exe

windows7-x64

b2ff192125...d7.exe

windows10-2004-x64

Sharing

General

Target

b2ff192125b2fc6af2ae615e0b93633786945ce9111902fda29d8fceee2d76d7
Size

163KB
Sample

240517-dgys1aec2v
MD5

266494f4f2aec028356dc423006b27ab
SHA1

d5ae20692f73f09dba487f16f7a3f864039f2948
SHA256

b2ff192125b2fc6af2ae615e0b93633786945ce9111902fda29d8fceee2d76d7
SHA512

ba80dee9f0be060d25f6e7b6264521adb85b7c2ca5f64923ff498cc8ddfe50bb322bb8fac7aa8f7e62068ec9906bb937aa6700c47de95d3596be4b1f2aee73f4
SSDEEP

1536:POcPZl86g4DutO8rcdxT1Fqh5VlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:GaZlvgBOecdx18h5VltOrWKDBr+yJb

Score

10^/10

gozi banker isfb persistence trojan

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

b2ff192125b2fc6af2ae615e0b93633786945ce9111902fda29d8fceee2d76d7.exe

Resource

win7-20240508-en

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

b2ff192125b2fc6af2ae615e0b93633786945ce9111902fda29d8fceee2d76d7.exe

Resource

win10v2004-20240508-en

gozi banker isfb persistence trojan

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Extracted

Family

gozi

Targets

- Target
  
  b2ff192125b2fc6af2ae615e0b93633786945ce9111902fda29d8fceee2d76d7
- Size
  
  163KB
- MD5
  
  266494f4f2aec028356dc423006b27ab
- SHA1
  
  d5ae20692f73f09dba487f16f7a3f864039f2948
- SHA256
  
  b2ff192125b2fc6af2ae615e0b93633786945ce9111902fda29d8fceee2d76d7
- SHA512
  
  ba80dee9f0be060d25f6e7b6264521adb85b7c2ca5f64923ff498cc8ddfe50bb322bb8fac7aa8f7e62068ec9906bb937aa6700c47de95d3596be4b1f2aee73f4
- SSDEEP
  
  1536:POcPZl86g4DutO8rcdxT1Fqh5VlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:GaZlvgBOecdx18h5VltOrWKDBr+yJb
Score

10^/10

persistence gozi banker isfb trojan
- Adds autorun key to be loaded by Explorer.exe on startup
  persistence
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
- Detects executables built or packed with MPress PE compressor
- UPX dump on OEP (original entry point)
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

gozibankerisfbpersistencetrojan

© 2018-2024

Terms | Privacy