ctrlINT What the industry said about every indicator, with the quote

GoziMalware

  • dreambot
  • gozi crm
  • gozi-isfb
  • papras
  • pe_ursnif
  • snifula
  • Ursnif

2000 Ursnif aka Snifula 2006 Gozi v1.0, Gozi CRM, CRM, Papras 2010 Gozi v2.0, Gozi ISFB, ISFB, Pandemyia(*) -> 2010 Gozi Prinimalka -> Vawtrak/Neverquest In 2006, Gozi v1.0 ('Gozi CRM' aka 'CRM') aka Papras was first observed. It was offered as a CaaS, known as 76Service.From MISP Galaxy

Last reported 4 years ago, by Group-IB3 reports

ATT&CK techniques

4 techniques · each with the sentence it comes from
  1. T1021.001Remote Desktop Protocol

    “The attackers also used Remote Desktop Protocol (RDP) for lateral movement.”

    Group-IBVendor
  2. T1056.001Keylogging

    “It has screen grabbing and keylogging functionalities.”

    Group-IBVendor
  3. T1505.003Web Shell

    “The list is uploaded through importing links to web shells.”

    Group-IBVendor
  4. T1684Social Engineering

    “…r of the service claimed that Prometheus TDS is an ANTIBOT redirect system designed to send out emails, work with traffic, and for social engineering.”

    Group-IBVendor

What the reports say

3 reports, newest first · the exact sentence from each

  1. “We see you, Gozi”

    Group-IBVendor
    We see you, Gozi

  2. “Analysis revealed that Campo Loader was used at various times to distribute TrickBot and Ursnif/Gozi bankers, etc.”

    Group-IBVendor
    Prometheus TDS

  3. “Similar scripts are used as a delivery mechanism for other trojans, such as Dridex and Ursnif.”

    Group-IBVendor
    Lock Like a Pro

Indicators in its reports

named in the reports above
Copy these 19 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with Gozi here?
No account needed. We do not store your IP address.