Rewterz Threat Alert – Gozi The Malware with a Thousand Faces

Severity

High

Analysis Summary

Originally a small banking Trojan, Gozi has undergone massive changes in the number of variants available to threat actors. Operating continuously since 2007, Gozi has infected millions of machines and done untold damage to all types of industries and users. At its core, Gozi variants carry similar traits across the board. Some of the similarities between versions are strings contained within the binary’s .bss section, man-in-the-browser attack, specific C2 check-in format, obfuscation of the C2 check-in, keylogging, email, FTP, IM accounts data and certificate grabbing, among others. Some of the specific strains carry differences that could easily be overlooked as most of the functionality of the RAT remains the same across the board. Goziat, an older variant, makes use of built-in Windows utilities and uses a different resource directory instead of the standard “images” directory. This variant typically targets .at top-level domains. Another variant, Gozi2RM3 or Gozi IAP2.0, has changes to the C2 structure. Communication is set in two stages. Stage 1 contains a hardcoded C2 in the initial infection binary. An ISP/geolocation deny list is also employed to pre-filter connections that could be researchers. Once the first stage is passed, the second stage pushes the main payload and true configuration. As with Gozi2RM3, a geofencing solution is in place. This particular variant has been bundled with a loader used by Emotet and Dridex. There are several variants of Gozi which have become unused. These include Dreambot, Saigon, and ISFB3/Ursnif-A. It’s easy to mistake one strain of Gozi for another; however, with the differences pointed out, triage and analysis should help to identify which strain of malware is presented. 

Impact

• Information theft
• Exposure of sensitive data 

Indicators of Compromise

SHA-256

• cb4f92bf9fef3708e7aeba5d8994a0502952d06374c8a83ff2c1ee0b7e603d35
• 21a03d9c845e446cb96eba7c93aa6403b8a9aaa744801e77468bf73c0507d028
• c486d8579308999b7d9f8cbb6de33b7a3976b9db5b98c06b7744adf5d5d11caf
• 644482a0851ff6f801e1e9afea1eee19e4f4de72b28895de9e3a4e43dd48ff1e
• C8456d507da3484d2151f051f439b2de13174be9f72f4f1f03abf52885adca1a
• b1ce263fb1945ae153e4c111fdfe0bd3d26cd09381ee21cf82ff5b115ad8ca77
• c2ee9cf24f0bddb07914503dbae35c4497d66f9ca01ea65108ef40ff13cbec02
• 6fa79786607c16fbf5f86d5978ad5c60d32e055946dc6d9d6d78310b1f7cc918
• 81734690442c224cf104fba0db8bacabdf3dc347bba3da3415a92de587df6d82
• b78390654db57946d3d551f9a34a488a726a0e7890746019b7313eddb74a9372
• 41e52cec2091e4451beadad93c5f693d5a008cf56eaf160f9fa4d577b1d707f6
• 5548507963e58e7c89e406452a4c00823db72b26c96cfcf7ed82799dacaf48d7
• a353dfb1b5eb69808244356cf9a784181c53eea2cb3f254749fa19c307c30cfc
• 8a2dace2a6fbd650b3e079f20f3886dd595044dbd4cb6bbab16023182f8d17af
• 495351fb739029a95a2bad9e80da3e6207b9bbd218c5c1d35f7e8eb0a090c04f
• 979048ab6e71c9589bb204e3017e72dfb8fe8d0b088fbccfa7e0b5791be89c68
• 87058836bd1c2c7a428ae4a3b4729035dab25795fe4da55b3f5793cc115c611a
• 52cb2bd9724270b3efe575894112d0a866734856a3257ddcfb24308e42861f6a
• ee8a404264b4d3144bc37ef7118da24c77dd15b20d38250badbf53140f7c1d2a
• 2d5c9af9419bfb08e1066b41f2d2daba93024fb6201ac079e0ec474c424d21ff
• 0ed9d5dcdc2ea4b90f056071feaec0463c3563eb89b67533741f079a22c7a1e7
• f2556099982b2b1ebea7443c863b8b205b6683112624f46393454e430e69aed5
• 8ded07a67e779b3d67f362a9591cce225a7198d2b86ec28bbc3e4ee9249da8a5
• 431f83b1af8ab7754615adaef11f1d10201edfef4fc525811c2fcda7605b5f2e
• 628cad1433ba2573f5d9fdc6d6ac2c7bd49a8def34e077dbbbffe31fb6b81dc9
• cacc1c3af8ad58b992c707bdf36ec1bd5f039dd80780ad2978cb142ccfe714d6
• 8d7ffebb0774e0dfe9d85f175cd5e1800dfd757bb5fbc4565a8f8a173e739ea5
• f3182febadb7a9cc0d43621bd9909688f9b0f7720d87673970be1c81249e208a
• 8e707c3afeaff2602615307988668ff8d2a3be20e5e41f34c6eb33c8deb6ceea

Remediation

• Block all threat indicators at your respective controls.
• Search for IOCs in your environment.