Rewterz Threat Alert – SAIGON Might be Ursnif

Severity

Medium

Analysis Summary

Ursnif (aka Gozi/Gozi-ISFB), discovered in 2006, may be one of the oldest banking Trojans still active. After its source code was leaked, a number of variants sprang up. SAIGON may be more of a generic backdoor than just a banking Trojan. During infection, SAIGON is stored in the registry as a Base64-encoded shellcode blob. On a scheduled basis, a task is used to launch the blob using PowerShell. Communication with its command and control servers is via multipart/form-data encoded requests over HTTPS using the POST command. Although SAIGON may share Ursnif’s source code. it may be designed for a more targeted attack approach than Ursnif.

Impact

• Credential theft
• Financial loss

Indicators of Compromise

MD5

• 30c23ec53a3443b6d53a6c8ad29cbcc8
• 2f699110efa494ffd630cea68689313d

SHA-256

• 431f83b1af8ab7754615adaef11f1d10201edfef4fc525811c2fcda7605b5f2e
• 628cad1433ba2573f5d9fdc6d6ac2c7bd49a8def34e077dbbbffe31fb6b81dc9

SHA1

• 0b18ea041f8b467158b96ab8c655e97329b95a45
• 8d008f218911943645a52303ada353156a7304bc

URL

• http[:]//softcloudstore[.]com
• https[:]//cdn-digicert-i31[.]com
• https[:]//cdn-gmail-us[.]com
• https[:]//cdn-google-eu[.]com
• https[:]//cdn-mozilla-sn45[.]com
• https[:]//google-download[.]com
• https[:]//mozilla-yahoo[.]com

Remediation

• Block all threat indicators at your respective controls.
• Always be suspicious about emails sent by unknown senders.
• Never click on the links/attachments sent by unknown senders.