We see you, Gozi

Group-IB has been tracking the Gozi banking Trojan since its early days. During recent threat hunting operations, we detected a new sample of the Trojan in the wild, on June 14. As soon as we conducted an in-depth investigation, we realized that the methods and techniques used had no relationship with those seen so far.

We are aware that reading articles on reverse engineering is often tedious and even difficult, which is why we will look at the latest version at a high level.

The kill chain resembles a matryoshka doll. All the stages are executed in memory by downloading, uncompressing and unpacking different stages, without directly dropping files to disk.

The first file we found was the executable “traktor.exe”, which self-decompresses itself in memory into the file “SEB6A8~1.EXE” and executes it. The new file then acts as a .NET downloader for the next-stage payload. Once executed, the downloader performs a GET request, passing through a shortener to try to hide the final URL of the resource. Shortener request: hXXps://tiny[.]one/yt52rdce → points to: cdn[.]discordapp[.]com/attachments/977479165555146754/984345564407812106/wiztree_4_08_setup_4_Qfmhjhgh.bmp

After being downloaded, it reverses the bytes (usually in order to interfere with detection mechanisms) and executes it. The new executed file is an obfuscated .NET DLL that serves as a packer.

Once launched in memory, the .NET packer decrypts and unpacks the next-stage payload in memory, which is the packed Gozi downloader. The DLL is obfuscated with various namespaces, classes and methods to throw analysts and reverse engineers off track.