Overview

overview

10

Static

static

3

bf306b0109...74.exe

windows7-x64

10

bf306b0109...74.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bf306b010921ee28b49bff7387808fbb99e25661ba89f0a434d0ad42ebd8c774

  • Size

    163KB

  • Sample

    240629-cp3w9asanj

  • MD5

    33bd089dc09d81015f951857587642fc

  • SHA1

    e010a67f0f0f4b6118d29e227c9017387012fc6d

  • SHA256

    bf306b010921ee28b49bff7387808fbb99e25661ba89f0a434d0ad42ebd8c774

  • SHA512

    2a68a5af7d96445611fb5f73e996b8733c863f578393de9ffdfc9c61ef8884b7af5074052bde63d86e9af240529868d6d7f22cc157c26aa1a0e083b87e2ed5bf

  • SSDEEP

    1536:PU4emvacCR8jDca0FxIG1Qotzst3lProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:BDU8EaMIG1QkIt3ltOrWKDBr+yJb

Score
10/10
gozibankerisfbpersistencetrojan

Malware Config

Extracted

Family

gozi

Targets

    • Target

      bf306b010921ee28b49bff7387808fbb99e25661ba89f0a434d0ad42ebd8c774

    • Size

      163KB

    • MD5

      33bd089dc09d81015f951857587642fc

    • SHA1

      e010a67f0f0f4b6118d29e227c9017387012fc6d

    • SHA256

      bf306b010921ee28b49bff7387808fbb99e25661ba89f0a434d0ad42ebd8c774

    • SHA512

      2a68a5af7d96445611fb5f73e996b8733c863f578393de9ffdfc9c61ef8884b7af5074052bde63d86e9af240529868d6d7f22cc157c26aa1a0e083b87e2ed5bf

    • SSDEEP

      1536:PU4emvacCR8jDca0FxIG1Qotzst3lProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:BDU8EaMIG1QkIt3ltOrWKDBr+yJb

    Score
    10/10
    gozibankerisfbpersistencetrojan

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks