gozi | be6667194e1d66042e43ed2f297ee8c46172d802f693e021f3c7b3a62da18e83 | Triage

Sharing

General

Target

be6667194e1d66042e43ed2f297ee8c46172d802f693e021f3c7b3a62da18e83
Size

1.7MB
Sample

241221-z95ynszpax
MD5

63321cff996c538481f0892446222ef8
SHA1

b57fded3fa4056544b62658d1f8b79dcc4ffbebb
SHA256

be6667194e1d66042e43ed2f297ee8c46172d802f693e021f3c7b3a62da18e83
SHA512

cffd7fc5018b75e36a03e4f5e23415c4f844ba72780b1343fa200a951175a59a54c2483a45958ae7eed084dfc34ebd23e1d57d69a7a7f1c8c445bd4b1eb299c1
SSDEEP

49152:lsskClXSMDbQmlu5z8RlA6yTizYG9Py+qcuQms33CHlXSMDbQmlu5z8R:lsskClXeIAxizYSy+qRlXe

Score

10^/10

gozi banker discovery isfb trojan

Malware Config

Extracted

Family

gozi

Targets

- Target
  
  be6667194e1d66042e43ed2f297ee8c46172d802f693e021f3c7b3a62da18e83
- Size
  
  1.7MB
- MD5
  
  63321cff996c538481f0892446222ef8
- SHA1
  
  b57fded3fa4056544b62658d1f8b79dcc4ffbebb
- SHA256
  
  be6667194e1d66042e43ed2f297ee8c46172d802f693e021f3c7b3a62da18e83
- SHA512
  
  cffd7fc5018b75e36a03e4f5e23415c4f844ba72780b1343fa200a951175a59a54c2483a45958ae7eed084dfc34ebd23e1d57d69a7a7f1c8c445bd4b1eb299c1
- SSDEEP
  
  49152:lsskClXSMDbQmlu5z8RlA6yTizYG9Py+qcuQms33CHlXSMDbQmlu5z8R:lsskClXeIAxizYSy+qRlXe
Score

10^/10

gozi banker discovery isfb trojan
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
- Gozi family
  gozi
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozibankerdiscoveryisfbtrojan

behavioral2

gozibankerdiscoveryisfbtrojan