gozi

General

Target

RNSM00318.7z
Size

10.4MB
Sample

241112-xs5kgaygrp
MD5

54348327c4b09f81b13add25c2ab47db
SHA1

cc0306fdf5969fa6a178c72785d3c033b1cbafa0
SHA256

8b9b04fbc3c5b9f839ec12b34b6d846cb69f3652838cf07ab995362fb48d2482
SHA512

d903610829f08fe33ab7385860d5aaba01b4a0b08d70b403bd7f70dfe5a9eeb790dd99a7976111f7ec07ac03c8eb87389924a66701cef4ef22c2e0606bbcf846
SSDEEP

196608:aSmt6v3FNVIFkWwodlKzk8nLH2azDEqmim+bOFQAJl0wwH:aSC6v3FNVIFkWwodQHL9hC+bqQGlMH

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://worldvibes.com.ng/lt/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  RNSM00318.7z
- Size
  
  10.4MB
- MD5
  
  54348327c4b09f81b13add25c2ab47db
- SHA1
  
  cc0306fdf5969fa6a178c72785d3c033b1cbafa0
- SHA256
  
  8b9b04fbc3c5b9f839ec12b34b6d846cb69f3652838cf07ab995362fb48d2482
- SHA512
  
  d903610829f08fe33ab7385860d5aaba01b4a0b08d70b403bd7f70dfe5a9eeb790dd99a7976111f7ec07ac03c8eb87389924a66701cef4ef22c2e0606bbcf846
- SSDEEP
  
  196608:aSmt6v3FNVIFkWwodlKzk8nLH2azDEqmim+bOFQAJl0wwH:aSC6v3FNVIFkWwodQHL9hC+bqQGlMH
Score

10^/10

gozi lokibot netwire banker botnet collection defense_evasion discovery persistence rat spyware stealer trojan
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
- Gozi family
  gozi
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Lokibot family
  lokibot
- NetWire RAT payload
  rat
- Netwire
  Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
  botnet stealer netwire
- Netwire family
  netwire
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Blocklisted process makes network request
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1