Full Report
Hunting the latest TTPs used for delivering the Trojan
Analysis Summary
# Tool/Technique: Gozi (ISFB) Downloader & Delivery Chain
## Overview
This report analyzes a multi-stage delivery chain used to deploy the **Gozi (also known as ISFB or Ursnif)** banking Trojan. The attack utilizes a combination of self-extracting archives, .NET-based downloaders, and sophisticated packing techniques to evade detection and deliver the final payload, which is designed for credential theft and financial fraud.
## Technical Details
- **Type:** Malware family (Banking Trojan / Downloader)
- **Platform:** Windows
- **Capabilities:** Credential theft, web injections, payload delivery, defense evasion (packing), and C2 communication.
- **First Seen:** June 2022 (Based on sample submission dates)
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566.002 - Phishing: Spearphishing Link (implied by Discord/TinyURL usage)
- **TA0002 - Execution**
- T1204.002 - User Execution: Malicious File
- **TA0005 - Defense Evasion**
- T1202 - Indirect Command Execution
- T1027.002 - Obfuscated Files or Information: Software Packing
- **TA0011 - Command and Control**
- T1071.001 - Application Layer Protocol: Web Protocols
## Functionality
### Core Capabilities
- **Multi-stage Loading:** Uses a Cabinet Self-Extractor (`traktor.exe`) to drop and execute the initial .NET downloader.
- **Stealthy Downloader:** The .NET component fetches a secondary payload (obfuscated as a `.bmp` file) from cloud services like Discord.
- **Payload Unpacking:** Employs a specific .NET packer (`Deocqpqvayitfaqvcfovoryc.dll`) to decrypt and reflectively load the Gozi downloader into memory.
- **C2 Communication:** Communicates with hardcoded domains to receive instructions and further modules (web injects).
### Advanced Features
- **Anti-Analysis:** Uses future-dated compiler stamps (e.g., year 2062 and 2074) to confuse automated analysis tools and forensic timelines.
- **Living-off-the-Cloud:** Leverages legitimate infrastructure (`cdn.discordapp.com`) and URL shorteners (`tiny.one`) to bypass domain reputation filters.
## Indicators of Compromise
- **File Hashes (SHA256):**
- `904CA32CB62DC94B61092F80FA78C5BC97D0A5394FA03438AEEC85ED87AB763E` (traktor.exe)
- `360703b2b2c324dde72dcd0651251c9e882e245c22d6b7e8c3163ed34ddb62b9` (.NET Downloader)
- `90660936CB65E0F929F32615EF400E0D0F80232F7F2003778C27E28B84468666` (.NET Packer)
- `011F6F038B1398C03AE15D3CB81412D32AD0AD554DFBB5D38FAE78577FB2B777` (Gozi Downloader)
- **File Names:** `traktor.exe`, `SEB6A8~1.EXE`, `wiztree_4_08_setup_4_Qfmhjhgh.bmp`
- **Network Indicators:**
- `cdn[.]discordapp[.]com/attachments/977479165555146754/984345564407812106/wiztree_4_08_setup_4_Qfmhjhgh.bmp`
- `tiny[.]one/yt52rdce`
- `update[.]zonealarm[.]com` (C2)
- `iiso[.]in` (C2)
- **Behavioral Indicators:** Execution of dropped .NET binaries from temporary folders; high-frequency network requests to Discord for non-image data disguised as `.bmp`.
## Associated Threat Actors
- Historically associated with the **Gozi/ISFB** developers and affiliates (often linked to various cybercriminal groups focused on financial gain).
## Detection Methods
- **Signature-based detection:** Scanning for the specific MD5/SHA256 hashes listed above.
- **Behavioral detection:** Monitoring for `winword.exe` or browser processes spawning unusual child processes like `cmd.exe` or unidentified .NET executables.
- **Network Monitoring:** Alerting on DNS queries to suspicious subdomains of `zonealarm.com` (spoofed) or unusual binary downloads from Discord CDN.
## Mitigation Strategies
- **Email Security:** Implement robust attachment filtering and link scanning to block spearphishing attempts.
- **Application Whitelisting:** Restrict the execution of unsigned binaries or binaries running from `%TEMP%` and `%APPDATA%` directories.
- **Network Filtering:** Block known malicious URL shorteners and monitor/limit access to Discord CDN within corporate environments if not required for business.
- **Endpoint Protection:** Deploy EDR solutions capable of detecting reflective code loading and memory-resident malware.
## Related Tools/Techniques
- **Ursnif / ISFB:** The primary malware family associated with this downloader.
- **Steganography (Pseudo):** Hiding malicious code inside files with image extensions (`.bmp`) to bypass simple gateway filters.