gozi | f373d2dc2b84e6ca4b323a53524ab5aec0186c13d04918d9e683c18c8ac3c421

General

Target
launcher.exe
Size 42.2MB
Sample260719-sqlbladv2m
SHA256 f373d2dc2b84e6ca4b323a53524ab5aec0186c13d04918d9e683c18c8ac3c421
MD5 2311e68badaa937bb7242d9d254cde8a
SHA1 f8be2918a30a98d68190567a6d0a37fa9ef38a44
SHA512 050fb40fbc47654cfb017fdb835f65b834fc5e5b992042d378b2be9a1067dda7bb9ffc56f6a6fccc855f064065d17339643148fc9eb29c269e8d8d1b69f04eee
SSDEEP 786432:TQXnft3RB9dhizk8D9CcsaHXrxdLIwKpdQEWwhLJA3Ba:TQ3ftlGzjgc3JK3QJmL3
TLSH
T1FBA7F14377870DEACCC22B78A59F63385730ED325E190B2B6688B5366D732DC9D1AB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

gozi

Targets

- Target
  launcher.exe
- Size 42.2MB
- SHA256 f373d2dc2b84e6ca4b323a53524ab5aec0186c13d04918d9e683c18c8ac3c421
- MD5 2311e68badaa937bb7242d9d254cde8a
- SHA1 f8be2918a30a98d68190567a6d0a37fa9ef38a44
- SHA512 050fb40fbc47654cfb017fdb835f65b834fc5e5b992042d378b2be9a1067dda7bb9ffc56f6a6fccc855f064065d17339643148fc9eb29c269e8d8d1b69f04eee
- SSDEEP 786432:TQXnft3RB9dhizk8D9CcsaHXrxdLIwKpdQEWwhLJA3Ba:TQ3ftlGzjgc3JK3QJmL3
- TLSH
  T1FBA7F14377870DEACCC22B78A59F63385730ED325E190B2B6688B5366D732DC9D1AB50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker defense_evasion discovery gozi isfb persistence ransomware spyware stealer trojan
- Family: Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
- Downloads MZ/PE file
- Drops file in Drivers directory
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral1
- Target
  NewMinecraft.pyc
- Size 17KB
- SHA256 b6e3f2d36d1a4d725c06b0dc3620ba47efa45e9d977efbfa01f957386b45294d
- MD5 de4e157a1241f637a1e0b2123ac57251
- SHA1 c7e7cf424caf9ed51ce133ecabf0064e4c370591
- SHA512 4874aa77efef51f82ccb890d27a3d54efd541f568b7433631b47e39560b4b01de500c2b1e1422b1381c788639a205a89898faeb2cbd381e409ff830e4c80e313
- SSDEEP 192:qEw1X0c6eOZwwjffmugWhNFzvRCKD3Lq5n+TJw9mE9wNcIXj8vewdw4At8IVJSQz:qxC1evMg6z5WITy9mgkxt8IVJJe4snP+
- TLSH
  T1407272467783D57BF8A9F3B0D456261AB774C8F5B340C76332AE9036AE9A3602C214DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution ransomware
behavioral2