Trojan:Win32/Gozi

Initial execution

The Gozi malware is usually spread by malicious websites, phishing emails, and opening a Word or Excel document, and requires macro to run. If the attachment or link in the email is clicked or opened, the malware inserts a Visual Basic (VB) script into the current user's temporary directory, where it is automatically decoded, and the malicious payload is downloaded.

The malware will attempt to inject itself into an active explorer.exe process after installation to establish persistence. If the injection is unsuccessful, Gozi will start a fresh instance of svchost.exe and inject itself.

The application programming interfaces (APIs) of popular web browsers including Chrome, Opera, Internet Explorer, and Firefox will be hooked by Gozi. For communication with its command-and-control (C2) server, the loader uses the Component Object Model (COM) object of the browsers.

The malware will then start keeping track of web activities and start stealing payment information as soon as the user accesses a payment or banking website. After that, it uses the IE (Internet Explorer) COM object to communicate the data it has gathered to a C2 server.

Autostart Technique:

• It adds the following registry entries to enable its automatic launch at every system startup:
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Communicates with C2

Gozi uses several types of methods to communicate with its command-and-control (C2) server. One of the most common techniques is to use the HTTP protocol to communicate with the C2 server over standard HTTP or HTTPS ports.

To avoid detection, it uses a technique called Domain Generation Algorithms (DGA) to generate a list of domain names that it can use to connect to the C2 server. This makes it difficult for security researchers to block or identify the C2 server.

It can also use encrypted communications to communicate with the C2 server, making it even more difficult to detect or intercept the traffic. Additionally, the malware may use other communication protocols, such as the Server Message Block (SMB) protocol, to communicate with the C2 server.

The malware is also capable of running orders received from the control server.

Contacts IPs, URLs and Domains

Indicators of compromise (IOCs)

• 3B3E3F142508409133B565C5EE076574340C6D2EDED21B8294DB1156C9474858
• 2A344E879DF9B689A9FCC5183DBFF6260EB51AE322DD7DAB8226CA6767A828A9
• 42978B12F0F6A35808049532CA02A2CBBD0181BC71D6C8525A7A4D2C4861EE4A