gozi | 2eaa226c0cf9214ae3ab1d16139eb5a2c89571b49e9bc8c35a719d7a5473b901 | Triage

Sharing

General

Target

2eaa226c0cf9214ae3ab1d16139eb5a2c89571b49e9bc8c35a719d7a5473b901
Size

626KB
Sample

241221-vn4fhatqck
MD5

aafd0bcf86c35202f2de2352570f9e7d
SHA1

1c17ca980d925b3c871ad73cf74f01eba857ddc5
SHA256

2eaa226c0cf9214ae3ab1d16139eb5a2c89571b49e9bc8c35a719d7a5473b901
SHA512

dc99c9c5d53aa5b494c023269c6ce07efa7e7751ee7b0ead8e4c3182574f8990b79a703e28384a4344085ce35f421ad480cd7c264e4808a3f659b64d0113cd11
SSDEEP

12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8ZS:+w1lEKOpuYxiwkkgjAN8ZS

Score

10^/10

gozi 999 banker discovery isfb trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

999

C2

config.edge.skype.com

146.70.35.138

146.70.35.142

Attributes

base_path
/phpadmin/
build
250227
exe_type
loader
extension
.src
server_id
50

rsa_pubkey.plain

aes.plain

Targets

- Target
  
  2eaa226c0cf9214ae3ab1d16139eb5a2c89571b49e9bc8c35a719d7a5473b901
- Size
  
  626KB
- MD5
  
  aafd0bcf86c35202f2de2352570f9e7d
- SHA1
  
  1c17ca980d925b3c871ad73cf74f01eba857ddc5
- SHA256
  
  2eaa226c0cf9214ae3ab1d16139eb5a2c89571b49e9bc8c35a719d7a5473b901
- SHA512
  
  dc99c9c5d53aa5b494c023269c6ce07efa7e7751ee7b0ead8e4c3182574f8990b79a703e28384a4344085ce35f421ad480cd7c264e4808a3f659b64d0113cd11
- SSDEEP
  
  12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8ZS:+w1lEKOpuYxiwkkgjAN8ZS
Score

10^/10

gozi 999 banker discovery isfb trojan
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
- Gozi family
  gozi
- Blocklisted process makes network request
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozi999bankerdiscoveryisfbtrojan

behavioral2

gozi999bankerdiscoveryisfbtrojan