Overview

overview

10

Static

static

3

tster.exe

windows10-2004-x64

10

tster.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tster.exe

  • Size

    11KB

  • Sample

    240602-3f34rsba6x

  • MD5

    feb6fd23d005b8d70446866b206042f8

  • SHA1

    d7d01f6639e0f060e91a35949f9bf346aa0ea81a

  • SHA256

    81f3c9ef76877647a56874054c58756d67e512ad55a0ab273dfa5e88dddd7c5c

  • SHA512

    20f86fa77e079bd3794c32e793a9adb79ad7d847ca8d74591321153330dfa9aa15d11279b45a9497fec910b58533cdeedc293858fa29d20ffb80f96d519c70da

  • SSDEEP

    192:52R8JP/PCS+plrpcV5K9+JPiukknPfhTx0ujmN+LKyOLi:58Q/a9plrpcVI9SKQfgutKyOL

Score
10/10
gozibankerisfbspywarestealertrojan

Malware Config

Extracted

Family

gozi

Targets

    • Target

      tster.exe

    • Size

      11KB

    • MD5

      feb6fd23d005b8d70446866b206042f8

    • SHA1

      d7d01f6639e0f060e91a35949f9bf346aa0ea81a

    • SHA256

      81f3c9ef76877647a56874054c58756d67e512ad55a0ab273dfa5e88dddd7c5c

    • SHA512

      20f86fa77e079bd3794c32e793a9adb79ad7d847ca8d74591321153330dfa9aa15d11279b45a9497fec910b58533cdeedc293858fa29d20ffb80f96d519c70da

    • SSDEEP

      192:52R8JP/PCS+plrpcV5K9+JPiukknPfhTx0ujmN+LKyOLi:58Q/a9plrpcVI9SKQfgutKyOL

    Score
    10/10
    gozibankerisfbspywarestealertrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks