gozi | d6a8c18e12a46b8fc92f811334d6ed5a386ce8bc2ec3fd36754d5f068ead3d3a | Triage

Sharing

General

Target

fc0cfca2abf11d1eb4bf24893542ee42_JaffaCakes118
Size

391KB
Sample

240928-lz5chazbqn
MD5

fc0cfca2abf11d1eb4bf24893542ee42
SHA1

1dacd4494342136715f14d3495888a7b150a070c
SHA256

d6a8c18e12a46b8fc92f811334d6ed5a386ce8bc2ec3fd36754d5f068ead3d3a
SHA512

18720645c9c4c28c6fde7858acc78d165206af73c2bea02f52765d0b60c0f7c0eb27a95e643b2ad7162c1b48c8677bcd6352efe80636a181c564755d31b73af3
SSDEEP

6144:BT5VKvS/Gn8QJKFzEaCu9OgkFtOlfpV7HmcqmlaGe5kFtOlfp0GSHXH4vY:fVKvSun8QJKFQtaNucrlaGaz2H4

Score

10^/10

gozi banker discovery isfb trojan

Malware Config

Extracted

Family

gozi

Attributes

build
217049

Targets

- Target
  
  fc0cfca2abf11d1eb4bf24893542ee42_JaffaCakes118
- Size
  
  391KB
- MD5
  
  fc0cfca2abf11d1eb4bf24893542ee42
- SHA1
  
  1dacd4494342136715f14d3495888a7b150a070c
- SHA256
  
  d6a8c18e12a46b8fc92f811334d6ed5a386ce8bc2ec3fd36754d5f068ead3d3a
- SHA512
  
  18720645c9c4c28c6fde7858acc78d165206af73c2bea02f52765d0b60c0f7c0eb27a95e643b2ad7162c1b48c8677bcd6352efe80636a181c564755d31b73af3
- SSDEEP
  
  6144:BT5VKvS/Gn8QJKFzEaCu9OgkFtOlfpV7HmcqmlaGe5kFtOlfp0GSHXH4vY:fVKvSun8QJKFQtaNucrlaGaz2H4
Score

10^/10

gozi banker discovery isfb trojan
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozibankerdiscoveryisfbtrojan

behavioral2