Gozi Isfb

Malware Profile Updated 3 months ago
Download STIX
Preview STIX
Gozi ISFB, also known as Ursnif and Dreambot, is a malicious software (malware) that has been actively developed and distributed worldwide. This malware is designed to exploit computer systems, primarily targeting the banking and financial sectors by stealing passwords and credentials from victims. The Gozi ISFB variant exhibits persistence in victim networks using command and control (C&C) domains, bot version, Group ID, RSA key, and Serpent encryption keys. It was observed to be one of the most active banking Trojans circulated through emails and exploit kits. Notably, the source code for this variant was leaked between 2013 and 2015, which has contributed to its widespread use and continuous development. The threat actor behind Gozi ISFB offers fast flux on infected computers particularly in Asia, Africa, and the Middle East, making it challenging to block content due to frequently changing IP addresses. This operation has been linked to numerous ransomware variants such as Bad Rabbit, GandCrab, LockBit 2.0, and STOP/DJVU, and several other malware samples including BankBot, Dreambot, Godzilla, Nymaim, Pony Loader, Privateloader, and SmokeLoader. Interestingly, Gozi ISFB's code was found to be quite basic and similar to those used by other malware families like Netwalker, ZLoader, and Smokeloader. In a significant shift, INDRIK SPIDER, a cybercriminal group, started using a variant of Gozi ISFB instead of their Dridex banking trojan in their operations. This transition marked a new era for the group approximately six months after the Office of Foreign Assets Control (OFAC) sanctions and the unsealing of the indictment against Yakubets and Turashev. During this period, WastedLocker was deployed in the first BGH campaign, indicating an evolution in the cybercrime landscape.
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.
IDVotesProfile Description
Ursnif
3
Ursnif, also known as Gozi or ISFB, is a type of malware that poses significant threats to computer systems and user data. It's often distributed through suspicious downloads, emails, or websites, infiltrating systems without the user's knowledge. Once installed, Ursnif can steal personal informatio
Dreambot
3
Dreambot, also known as Ursnif and Gozi ISFB, is a malicious software (malware) designed to steal passwords and credentials, primarily targeting the banking and financial sectors. It has been described by threat researchers as "frighteningly lucrative," compared to the already profitable cybercrime
Smokeloader
2
SmokeLoader is a malicious software (malware) that has been extensively used by threat actors, particularly those associated with the Phobos ransomware. It functions as a backdoor trojan, often arriving on victims' systems via spoofed email attachments embedded with hidden payloads. Once downloaded,
Netwalker
1
NetWalker is a highly profitable ransomware kit, known for its ability to disable antivirus software on Windows 10 systems and encrypt files, adding a random extension to the encrypted ones. Once executed, it disrupts operations and can even hold data hostage for ransom. It has been observed that Ne
Zloader
1
ZLoader is a type of malware, malicious software designed to exploit and damage computer systems. It can infiltrate systems through suspicious downloads, emails, or websites, often unbeknownst to the user. Once inside, it has the capacity to steal personal information, disrupt operations, or even ho
Kbot
1
KBot, a malware identified and analyzed by Kaspersky in February 2020, is one of the most recent viruses to spread in the wild. This malicious software, designed to exploit and damage computers or devices, typically infiltrates systems through suspicious downloads, emails, or websites, often unbekno
Isfb
1
ISFB, also known as Gozi or Ursnif, is a form of malware that has been a significant part of the cyberthreat landscape for several years. This malicious software is designed to exploit and damage computer systems, often infiltrating through suspicious downloads, emails, or websites without the user'
BitPaymer
1
BitPaymer is a type of malware that operates as ransomware, encrypting files and demanding payment for their release. It was operated by the GOLD DRAKE threat group and was later reworked and renamed DoppelPaymer by the GOLD HERON threat group. As part of the Ransomware as a Service (RaaS) model tha
Indrik Spider
1
Indrik Spider is a notable threat actor known for its cybercriminal activities, particularly in the realm of ransomware. In July 2017, the group entered the targeted ransomware sphere with BitPaymer, using file-sharing platforms to distribute the BitPaymer decryptor. This shift in operations saw Ind
Dridex
1
Dridex is a well-known malware, specifically a banking Trojan, that has been utilized by cybercriminals to exploit and damage computer systems. The malware infiltrates systems through dubious downloads, emails, or websites, often unbeknownst to the user, and can steal personal information, disrupt o
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Malware
Exploit
Trojan
Bot
Ransomware
Encryption
Spam
Associated Malware
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
GoziUnspecified
3
Gozi is a notorious malware that has been linked to numerous cyber attacks. It's typically delivered through sophisticated malvertising techniques, often used in conjunction with other initial access malware such as Pikabot botnet agent and IcedID information stealer. When an individual accesses a c
Bad RabbitUnspecified
1
Bad Rabbit is a notorious malware that emerged in October 2017, primarily targeting corporate networks. It operates as ransomware, encrypting the victim's files and disk while offering a means of decryption for a ransom. The malicious software uses fake Adobe Flash installer advertisements to lure v
LockbitUnspecified
1
LockBit is a type of malware, specifically ransomware, that infiltrates systems to exploit and damage them. It can enter your system through various channels such as suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, it can steal personal information, disrupt
WastedLockerUnspecified
1
WastedLocker is a type of malware developed by the Evil Corp Group, known for its malicious activities. This malware variant was first identified in 2020 and is part of an evolution of ransomware that began with Dridex, followed by DoppelPaymer developed in 2019, and then WastedLocker. The malware i
Associated Threat Actors
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
GandcrabUnspecified
1
GandCrab, a threat actor, is known for its malicious activities involving ransomware attacks. Originating from Russian origins and evolving from Team Truniger, a former GandCrab affiliate, the group has been linked to numerous ransomware variants including Bad Rabbit, LockBit 2.0, STOP/DJVU, and REv
Associated Vulnerabilities
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Source Document References
Information about the Gozi Isfb Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
SourceCreatedAtTitle
InfoSecurity-magazine
6 months ago
Why Bulletproof Hosting is Key to Cybercrime-as-a-Service
MITRE
a year ago
WastedLocker: A New Ransomware Variant Developed By The Evil Corp Group
BankInfoSecurity
a year ago
New Malware WikiLoader Targeting Italian Organizations
CERT-EU
a year ago
Last of the Gozi 3 gets 36 months for malware ops scheme
MITRE
a year ago
Ursnif Variant Dreambot Adds Tor Functionality | Proofpoint
MITRE
a year ago
INDRIK SPIDER: WastedLocker Superseded by Hades Ransomware
CERT Polska
a year ago
Ostap malware analysis (Backswap dropper)
Fortinet
a year ago
Are Internet Macros Dead or Alive? | FortiGuard labs