March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert – Mirai Botnet – Active IOCs
April 6, 2022
Rewterz Threat Alert – Lazarus APT Group – Active IOCs
April 6, 2022
Rewterz Threat Alert – Mirai Botnet – Active IOCs
April 6, 2022
Rewterz Threat Alert – Lazarus APT Group – Active IOCs
April 6, 2022
Severity
High
Analysis Summary
Originally a small banking Trojan, Gozi has undergone massive changes in the number of variants available to threat actors. Operating continuously since 2007, Gozi has infected millions of machines and done untold damage to all types of industries and users. At its core, Gozi variants carry similar traits across the board. Some of the similarities between versions are strings contained within the binary’s .bss section, man-in-the-browser attack, specific C2 check-in format, obfuscation of the C2 check-in, keylogging, email, FTP, IM accounts data and certificate grabbing, among others. Some of the specific strains carry differences that could easily be overlooked as most of the functionality of the RAT remains the same across the board. Goziat, an older variant, makes use of built-in Windows utilities and uses a different resource directory instead of the standard “images” directory. This variant typically targets .at top-level domains. Another variant, Gozi2RM3 or Gozi IAP2.0, has changes to the C2 structure. Communication is set in two stages. Stage 1 contains a hardcoded C2 in the initial infection binary. An ISP/geolocation deny list is also employed to pre-filter connections that could be researchers. Once the first stage is passed, the second stage pushes the main payload and true configuration. As with Gozi2RM3, a geofencing solution is in place. This particular variant has been bundled with a loader used by Emotet and Dridex. There are several variants of Gozi which have become unused. These include Dreambot, Saigon, and ISFB3/Ursnif-A. It’s easy to mistake one strain of Gozi for another; however, with the differences pointed out, triage and analysis should help to identify which strain of malware is presented.
Impact
- Information theft
- Exposure of sensitive data
Indicators of Compromise
MD5
- be1195fc5385d9946a4df7a3b6e0d0c5
SHA-256
- 8196671c90bfd8cb28e39930248b861c01aab285454e0888bcfbea6aafeb1278
SHA-1
- 2ce6f8bd2c834d6d6b4fc8b21bcb8588a4082f72
Remediation
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.