#gozi — Public Fediverse posts

#MarcoTravaglio #IlFattoQuotidiano #Editoriale #Satira #Politica #LaFranceInsoumise #Gozi #SandroGozi #Albanese #FrancescaAlbanese

My #Gozi banking malware detector for @zeek is almost ready. Just some more testing on real networks.

#opensource #cybersecurity #zeek

I may have figured out a couple ways to detect #Gozi #malware with #zeek. Stay tuned.

للمره المليون لا تحميل او تدخل رابط من اعلان من بحث في قوقل
---
RT @1ZRR4H
1/ DEV-0569, current distribution via #GoogleAds.

1.- #Gozi aka #Ursnif (bot) ↓
2.- #RedLine (stealer) ↓
And if the conditions are right, possibly:
3.- #CobaltStrike (C2) ↓
4.- #Royal Ransomware 💥

(No more BatLoader in the infection chain)
https://twitter.com/1ZRR4H/status/1616682530832252930

Found in the wild! Allegedly Gozi malware stage 1.

Attack path:
phishing -> xlsx macro -> chechoa[.]com -> commandline calc.exe -s 6636702. -> Stage 2

https://bazaar.abuse.ch/sample/eef902138fc1ee637b41bbecd442a64b691b5b9aae15d2c822ac983ef93e4616/

https://www.virustotal.com/gui/file/eef902138fc1ee637b41bbecd442a64b691b5b9aae15d2c822ac983ef93e4616/detection/f-eef902138fc1ee637b41bbecd442a64b691b5b9aae15d2c822ac983ef93e4616-1669969590

#gozi #ursnif

@th3_protoCOL

Current #payloads:

-ZipCosdaz.exe (#RedLine)
C2: 193.56.146.114:44271
Botnet: NewBuild

- ZipCosdaz1.exe (#Ursnif aka #Gozi)
C2 servers:
45.11.182.97
79.132.128.108
91.241.93.98
79.132.128.109
91.242.217.28
91.241.93.111
Botnet: 2503

- ConsoleDWS.exe (Destroy Windows 10 Spying)
GitHub repo: https://github.com/spinda/Destroy-Windows-10-Spying

+ And another download URL: archiverportal[.]space/porn.php

RT @[email protected]

Questo è uno dei tweet nei quali, appena due settimane fa, ho difeso la legittimità della scelta di #Gozi
Giusto per illuminare chi (come Rampino) ha straparlato di un mio attacco al soggetto, motivato da pregiudizio ideologio o salcazzo di complotto. https://twitter.com/mazzettam/status/1156496222917730304