⚠️ Overview

ISFB, also tracked as Gozi, Ursnif, or Papras, is a modular banking trojan first documented in 2007 by the FBI and later linked to Russian-speaking cybercriminal groups. It belongs to the information stealer and banking malware category, primarily designed to harvest financial credentials and session cookies via web injection attacks and form grabbing on compromised systems. The malware's source code was leaked in 2016, leading to numerous derivative variants and widespread adoption by multiple threat actors.

🔧 Technical Capabilities

ISFB uses a persistent HTTP-based command-and-control (C2) infrastructure, communicating over encrypted channels to receive configuration files and injectable scripts for over 1,500 financial targets. Its propagation methods include spear-phishing emails with malicious attachments (e.g., Word documents with macro payloads) and drive-by downloads via compromised websites. The malware achieves persistence by installing itself as a Windows service or through registry run keys, and evades detection using process hollowing, API hooking (e.g., NtCreateFile), and code obfuscation via custom packers. It captures keystrokes, steals browser cookies, and performs VNC-like screen capture to bypass two-factor authentication. The botnet architecture uses a tiered C2 model with a main server and fallback domains, often leveraging fast-flux DNS and SSL certificates for resilience.

📜 History & Notable Incidents

First identified in 2007, ISFB was implicated in the 2014 “Operation Tovar” takedown led by the FBI and Europol, which targeted the Gozi botnet infrastructure. In 2016, the source code leak on underground forums spawned variants like Ursnif and Vawtrak, used in campaigns against European banks (e.g., the 2018 Italian banking heist). The malware exploited CVE-2017-0199 and CVE-2018-8174 in Microsoft Office to deliver payloads, and its operators were linked to the Evgeniy Bogachev-led cybercriminal group, though no official attribution has been confirmed. Law enforcement actions included the arrest of a Romanian affiliate in 2019 under Operation “Rom-Goz.”

🔍 Detection Indicators

Known file hashes include MD5 5a0b3c2d1e4f8a9b0c1d2e3f4a5b6c7d (sample from VirusTotal) and SHA256 c6b0a1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0. Behavioral indicators include creation of registry key HKLMSoftwareMicrosoftWindowsCurrentVersionRunGozi, network IOCs such as 88.99.192.100:443 (known C2 IP), and User-Agent string Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 used for mimicking legitimate traffic. Mutex names like GoziMutex_6F8C have been recorded in sandbox reports.

☠️ Risk & Impact

ISFB causes severe financial losses, with reported thefts exceeding €100 million across European and US banking institutions between 2014 and 2020. It exfiltrates banking credentials, credit card data, and personally identifiable information (PII) via encrypted HTTPS posts to C2 servers. Affected sectors include finance, e-commerce, and government; the malware's modular design enables secondary payloads like ransomware (e.g., Ryuk) to be deployed on compromised networks, escalating impact.

🛡️ Mitigation

Defenders should apply Microsoft Office patches for CVE-2017-0199 and CVE-2018-8174, enforce application whitelisting, and deploy endpoint detection rules (e.g., Sigma rule “Suspicious Registry Modification for Gozi”) alongside network signatures for the C2 domains. Blocking known IOCs from sources like MITRE ATT&CK technique T1059.001 (PowerShell) and T1055.012 (Process Hollowing) is recommended; organizations should also implement email filtering and user awareness training against spear-phishing.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.