Isfb

Malware Profile Updated 3 months ago

Download STIX

Preview STIX

ISFB, also known as Gozi or Ursnif, is a form of malware that has been a significant part of the cyberthreat landscape for several years. This malicious software is designed to exploit and damage computer systems, often infiltrating through suspicious downloads, emails, or websites without the user's knowledge. Once inside, it can steal personal information, disrupt operations, or even hold data hostage for ransom. ISFB, which is particularly prevalent in Poland, is being replaced with something that has roots in the same Carberp leak. It's interesting to note that the longevity of Gozi malware's use by criminals is partially attributed to an incident where the source code to the Gozi "ISFB" variant leaked sometime between 2013 and 2015. The BatLoader malware is a serious threat that delivers additional malware and tools, including the notorious Vidar Stealer and ISFB. Recently, eSentire conducted a comprehensive analysis of BatLoader, revealing its capability to drop several well-known malware or malicious tools such as ISFB, SystemBC RAT, Redline Stealer, and Vidar Stealer. Furthermore, BatLoader has the potential to deliver other malware and tools, including ISFB, Vidar Stealer, Cobalt Strike, Syncro RMM, and SystemBC RAT via fake installers. The downloaded malware samples are typically bankers like KBot and Gozi ISFB. In recent events, on March 6, 2023, Palo Alto Networks Unit 42 reported via Twitter about Gozi (ISFB/Ursnif) malware targeting Italy. A few months later, scripts began delivering various types of banking malware such as Tinba, Ramnit, or ISFB. Threat researchers describe this evolving threat as "frighteningly lucrative, even compared to the already lucrative cybercrime market." Variations based on ISFB, including GozNym or Dreambot, are still prevalent today. In February 2016, GozNym became popular again after incorporating leaked ISFB code.

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.

ID	Votes	Profile Description
Gozi	2	Gozi is a notorious malware that has been linked to numerous cyber attacks. It's typically delivered through sophisticated malvertising techniques, often used in conjunction with other initial access malware such as Pikabot botnet agent and IcedID information stealer. When an individual accesses a c
Goznym	2	Goznym is a malicious software, or malware, that gained significant attention in February 2016 after incorporating leaked ISFB code. This potent combination led to its resurgence in the cybercrime market, where it was employed by threat actors to exploit and damage computer systems. The malware coul
Gozi Isfb	1	Gozi ISFB, also known as Ursnif and Dreambot, is a malicious software (malware) that has been actively developed and distributed worldwide. This malware is designed to exploit computer systems, primarily targeting the banking and financial sectors by stealing passwords and credentials from victims.
Vidar Stealer	1	Vidar Stealer is a prolific infostealer malware that operates on a malware-as-a-service model, sold through ads and forums on the dark web and Telegram groups. It's designed to exploit and damage computer systems by stealing personal information, disrupting operations, or holding data for ransom. Th
Dreambot	1	Dreambot, also known as Ursnif and Gozi ISFB, is a malicious software (malware) designed to steal passwords and credentials, primarily targeting the banking and financial sectors. It has been described by threat researchers as "frighteningly lucrative," compared to the already profitable cybercrime
Kbot	1	KBot, a malware identified and analyzed by Kaspersky in February 2020, is one of the most recent viruses to spread in the wild. This malicious software, designed to exploit and damage computers or devices, typically infiltrates systems through suspicious downloads, emails, or websites, often unbekno

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

Malware

Malware Drop...

Rat

Cybercrime

Rmm

Associated Malware

To see the evidence that has resulted in this association, create a free account

ID	Type	Votes	Profile Description
Carberp	Unspecified	1	Carberp is a notable malware that has been widely used and modified by various threat actors. Its source code, which was leaked in 2013, has become the basis for a multitude of other malicious software due to its sophisticated design and capabilities. The malware can infiltrate systems through dubio
Batloader	Unspecified	1	Batloader is a malware downloader posing as installers or updates for legitimate applications such as Microsoft Teams, Zoom, and others. This malicious software can infiltrate systems through suspicious downloads, emails, or websites, often unbeknownst to the user. Once inside, it can steal personal
Redline Stealer	Unspecified	1	RedLine Stealer is a type of malware that has been causing significant disruption in the digital landscape. This malicious software infiltrates computer systems, often without the user's knowledge, via suspicious downloads, emails, or websites, and then proceeds to steal personal information, disrup
Systembc	Unspecified	1	SystemBC is a malicious software (malware) that has been used in various cyber attacks to exploit and damage computer systems. This malware was observed in 2023, being heavily used with BlackBasta and Quicksand. It has been deployed by teams using BlackBasta during their attacks. Play ransomware act

Associated Threat Actors

To see the evidence that has resulted in this association, create a free account

ID	Type	Votes	Profile Description
No associations to display

Associated Vulnerabilities

To see the evidence that has resulted in this association, create a free account

ID	Type	Votes	Profile Description
No associations to display

Source Document References

Information about the Isfb Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source	CreatedAt	Title
CERT-EU	a year ago	BatLoader Malware Dropper Continues to Pose a Threat to Organizations in 2023 - CYBERWARZONE
CERT-EU	a year ago	Last of the Gozi 3 gets 36 months for malware ops scheme
Unit42	a year ago	Finding Gozi: Unit 42 Wireshark Quiz, March 2023
CERT Polska	a year ago	Newest addition to a happy family: KBOT
CERT Polska	a year ago	Ostap malware analysis (Backswap dropper)
CERT Polska	a year ago	Nymaim revisited