ISFBMalware
- gozi isfb
- pandemyia
2006 Gozi v1.0, Gozi CRM, CRM, Papras 2010 Gozi v2.0, Gozi ISFB, ISFB, Pandemyia(*) In September 2010, the source code of a particular Gozi CRM dll version was leaked. This led to two main branches: one became known as Gozi Prinimalka, which was merge with Pony and became Vawtrak/Neverquest. The other branch became known as Gozi ISFB, or ISFB in short.From MISP Galaxy
Last reported 4 years ago, by Group-IB1 report
ATT&CK techniques
1 technique · each with the sentence it comes from- T1056.001Keylogging
“It has screen grabbing and keylogging functionalities.”
What the reports say
1 report, newest first · the exact sentence from each-
We see you, Gozi“The ISFB Trojan also known as Gozi ISFB first appeared in 2014.”
Indicators in its reports
named in the reports above- hxxps://tiny[.]one/yt52rdcein 1 report
- tiny[.]onein 1 report
- update.zonealarm[.]comin 1 report
- iiso[.]inin 1 report
- a0bb2d133b174436a9d4cce527fb78d7in 1 report
- 8e72e0115e01f32a…641c6b66ab45in 1 report
- 904ca32cb62dc94b…85ed87ab763ein 1 report
- 63fdefb66fd14dc92a7d1f773d6f619bin 1 report
- 0a96e7edc7a7e4b8…9e21453f9eb0in 1 report
- 360703b2b2c324dd…3ed34ddb62b9in 1 report
- 2b348e0106f20c14615212d7eff0db88in 1 report
- 4dcd93a1cfd7f630…298582b8bd39in 1 report
- 90660936cb65e0f9…e28b84468666in 1 report
- 1c847fed91ba95a65ff0160757c5b187in 1 report
- 17ca3fa3bec22507…59134f4cd3aain 1 report
- 3ef96cfb78cb5539…ef72bdb15ecdin 1 report
- d3d4b79106465363155a3f4f6c1a5e05in 1 report
- 9e978ad8c58fbbe5…87023161a5b8in 1 report
- 011f6f038b1398c0…78577fb2b777in 1 report
Copy these 19 indicators · defanged
Thanks — we review every report.