GozNymThreat actor
IBM X-Force Research uncovered a Trojan hybrid spawned from the Nymaim and Gozi ISFB malware. It appears that the operators of Nymaim have recompiled its source code with part of the Gozi ISFB source code, creating a combination that is being actively used in attacks against more than 24 U. S. and Canadian banks, stealing millions of dollars so far. X-Force named this new hybrid GozNym.From MISP Galaxy
Last reported 4 years ago, by Group-IB2 reports
ATT&CK techniques
1 technique · each with the sentence it comes from- T1056.001Keylogging
“It has screen grabbing and keylogging functionalities.”
What the reports say
2 reports, newest first · the exact sentence from each-
We see you, Gozi“Given that the source code for Gozi ISFB is available online, there are now various forks based on ISFB such as GozNym or Dreambot.”
-
Incident Education: Sales Ammo for the IT Arsenal“A recently unsealed US indictment detailed how the GozNym cybercrime group was behind $100 million in damages.”
Indicators in its reports
named in the reports above- hxxps://tiny[.]one/yt52rdcein 1 report
- tiny[.]onein 1 report
- update.zonealarm[.]comin 1 report
- iiso[.]inin 1 report
- a0bb2d133b174436a9d4cce527fb78d7in 1 report
- 8e72e0115e01f32a…641c6b66ab45in 1 report
- 904ca32cb62dc94b…85ed87ab763ein 1 report
- 63fdefb66fd14dc92a7d1f773d6f619bin 1 report
- 0a96e7edc7a7e4b8…9e21453f9eb0in 1 report
- 360703b2b2c324dd…3ed34ddb62b9in 1 report
- 2b348e0106f20c14615212d7eff0db88in 1 report
- 4dcd93a1cfd7f630…298582b8bd39in 1 report
- 90660936cb65e0f9…e28b84468666in 1 report
- 1c847fed91ba95a65ff0160757c5b187in 1 report
- 17ca3fa3bec22507…59134f4cd3aain 1 report
- 3ef96cfb78cb5539…ef72bdb15ecdin 1 report
- d3d4b79106465363155a3f4f6c1a5e05in 1 report
- 9e978ad8c58fbbe5…87023161a5b8in 1 report
- 011f6f038b1398c0…78577fb2b777in 1 report
Copy these 19 indicators · defanged
Thanks — we review every report.