Overview

overview

10

Static

static

3

2025-02-20...ia.exe

windows7-x64

10

2025-02-20...ia.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-02-20_8add9474e9b9211261ace0fbbbbc25e0_mafia

  • Size

    1.0MB

  • Sample

    250220-z5dcvsxks8

  • MD5

    8add9474e9b9211261ace0fbbbbc25e0

  • SHA1

    67a71ac5d8a8360b3d1e955d0bebbcfb838e3488

  • SHA256

    2dc66f9035a656a8fd6b7e7429637dc1db895b6cfe07ff4d4cbdbaeacc4acfca

  • SHA512

    e8221073538f6358928348209339898cc392232b7a8e0ca650e771f08997793bf1387e638543ad2df4bebdfe02942b088fd60734ee3e2669d62d2e4a5b823622

  • SSDEEP

    24576:uICr2UPu3ZBZApEgFDBDohZYTyn2pagiUvmIpxdPDJ2nHqcJ:ufIZBIEgxBDWZYT+2pbjv92nH

Score
10/10
gozibankercollectiondiscoverytrojan

Malware Config

Targets

    • Target

      2025-02-20_8add9474e9b9211261ace0fbbbbc25e0_mafia

    • Size

      1.0MB

    • MD5

      8add9474e9b9211261ace0fbbbbc25e0

    • SHA1

      67a71ac5d8a8360b3d1e955d0bebbcfb838e3488

    • SHA256

      2dc66f9035a656a8fd6b7e7429637dc1db895b6cfe07ff4d4cbdbaeacc4acfca

    • SHA512

      e8221073538f6358928348209339898cc392232b7a8e0ca650e771f08997793bf1387e638543ad2df4bebdfe02942b088fd60734ee3e2669d62d2e4a5b823622

    • SSDEEP

      24576:uICr2UPu3ZBZApEgFDBDohZYTyn2pagiUvmIpxdPDJ2nHqcJ:ufIZBIEgxBDWZYT+2pbjv92nH

    Score
    10/10
    gozibankercollectiondiscoverytrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Gozi family

      gozi

    • Deletes itself

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery

    • Enumerates processes with tasklist

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks