ThaiCERT    ETDA    MDES
Report
Search
Home > List all groups > List all tools > List all groups using tool Gozi ISFB

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Tool: Gozi ISFB

NamesGozi ISFB
ISFB
Pandemyia
CategoryMalware
TypeBanking trojan, Info stealer, Credential stealer, Botnet
Description2006 Gozi v1.0, Gozi CRM, CRM, Papras
2010 Gozi v2.0, Gozi ISFB, ISFB, Pandemyia(*)

In September 2010, the source code of a particular Gozi CRM dll version was leaked. This led to two main branches: one became known as Gozi v2, which was merged with Pony and became Vawtrak/Neverquest.

The other branch became known as Gozi ISFB, or ISFB in short. Webinject functionality was added to this version.

There is one panel which often was used in combination with ISFB: IAP. The panel's login page comes with the title 'Login - IAP'. The body contains 'AUTHORIZATION', 'Name:', 'Password:' and a single button 'Sign in' in a minimal design. Often, the panel is directly accessible by entering the C2 IP address in a browser. But there are ISFB versions which are not directly using IAP. The bot accesses a gate, which is called the 'DreamBot' gate.

ISFB often was protected by Rovnix. This led to a further complication in the naming scheme - many companies started to call ISFB Rovnix. Because the signatures started to look for Rovnix, other trojans protected by Rovnix (in particular ReactorBot and Rerdom) sometimes got wrongly labelled.

In April 2016 a combination of Gozi ISFB and Nymaim was detected. This breed became known as GozNym. The merge uses a shellcode-like version of Gozi ISFB, that needs Nymaim to run. The C2 communication is performed by Nymaim.
Information<https://www.prodefence.org/malware-analysis-gozi-ifsb-bank-trojan-aka-ursnif/>
<https://blog.trendmicro.com/trendlabs-security-intelligence/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader/>
<https://blog.talosintelligence.com/2019/01/amp-tracks-ursnif.html>
<https://blog.minerva-labs.com/attackers-insert-themselves-into-the-email-conversation-to-spread-malware>
<https://lokalhost.pl/gozi_tree.txt>
<https://isc.sans.edu/forums/diary/Reviewing+the+spam+filters+Malspam+pushing+GoziISFB/23245>
<http://blog.talosintelligence.com/2018/03/gozi-isfb-remains-active-in-2018.html>
<https://www.cylance.com/en_us/blog/threat-spotlight-ursnif-infostealer-malware.html>
<https://www.vkremez.com/2018/08/lets-learn-in-depth-reversing-of-recent.html>
<https://www.rsa.com/de-de/resources/pandemiya-emerges-new-malware-alternative-zeus-based>
<https://blog.malwarebytes.com/threat-analysis/2017/04/binary-options-malvertising-campaign-drops-isfb-banking-trojan/>
<https://www.cyberbit.com/blog/endpoint-security/new-ursnif-malware-variant/>
<https://journal.cecyf.fr/ojs/index.php/cybin/article/view/15>
<https://0ffset.net/reverse-engineering/analyzing-com-mechanisms-in-malware/>
<https://www.fireeye.com/blog/threat-research/2017/11/ursnif-variant-malicious-tls-callback-technique.html>
<https://0ffset.net/reverse-engineering/malware-analysis/analysing-isfb-loader/>
<https://arielkoren.com/blog/2016/11/01/ursnif-malware-deep-technical-dive/>
<https://github.com/gbrindisi/malware/tree/master/windows/gozi-isfb>
<https://blog.yoroi.company/research/ursnif-the-latest-evolution-of-the-most-popular-banking-malware/>
<https://www.cybereason.com/blog/new-ursnif-variant-targets-japan-packed-with-new-features>
<https://www.telekom.com/en/blog/group/article/lolsnif-tracking-another-ursnif-based-targeted-campaign-600062>
MITRE ATT&CK<https://attack.mitre.org/software/S0386/>
Malpedia<https://malpedia.caad.fkie.fraunhofer.de/details/win.isfb>

Last change to this tool card: 24 May 2020

Download this tool card in JSON format

Previous: Gozi
Next: Gozi v2

All groups using tool Gozi ISFB

ChangedNameCountryObserved

APT groups

 TA530[Unknown]2016-Nov 2016 

Other groups

 Bamboo Spider, TA544[Unknown]2016-May 2020X
 TA554[Unknown]2017 

3 groups listed (1 APT, 2 other, 0 unknown)

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
E-mail report@thaicert.or.th
PGP Download PGP key