Overview

overview

10

Static

static

10

771370fbee...8f.exe

windows7-x64

10

771370fbee...8f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    771370fbee8cbd8f5de79670e2e3e2529389bfc869c80f2524ae9b3a74c2e88f

  • Size

    163KB

  • Sample

    240628-25tqysxgkk

  • MD5

    6fcc1a5f9cfee97bd224a32186a31861

  • SHA1

    ad9137a65c7cc452e65cbd1049b291f532c3b6fb

  • SHA256

    771370fbee8cbd8f5de79670e2e3e2529389bfc869c80f2524ae9b3a74c2e88f

  • SHA512

    1a1ac6d312ea3c178111641b1ee4475912935eec5bb437c2441654886e2f7774c7f82be60963f9fc959189a57ca75bf57f454219d34e0f13733cf9c3f5498864

  • SSDEEP

    1536:PmgMVUboU1xMQ1AC2bMkV3iJ7LrDXlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:uKboU16uMMk4zXltOrWKDBr+yJb

Score
10/10
gozibankerisfbpersistencetrojan

Malware Config

Extracted

Family

gozi

Targets

    • Target

      771370fbee8cbd8f5de79670e2e3e2529389bfc869c80f2524ae9b3a74c2e88f

    • Size

      163KB

    • MD5

      6fcc1a5f9cfee97bd224a32186a31861

    • SHA1

      ad9137a65c7cc452e65cbd1049b291f532c3b6fb

    • SHA256

      771370fbee8cbd8f5de79670e2e3e2529389bfc869c80f2524ae9b3a74c2e88f

    • SHA512

      1a1ac6d312ea3c178111641b1ee4475912935eec5bb437c2441654886e2f7774c7f82be60963f9fc959189a57ca75bf57f454219d34e0f13733cf9c3f5498864

    • SSDEEP

      1536:PmgMVUboU1xMQ1AC2bMkV3iJ7LrDXlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:uKboU16uMMk4zXltOrWKDBr+yJb

    Score
    10/10
    gozibankerisfbpersistencetrojan

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Detects executables built or packed with MPress PE compressor

    • UPX dump on OEP (original entry point)

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks