SYMBOLCOMMON_NAMEaka. SYNONYMS
win.gozi (Back to overview)

Gozi

aka: CRM, Gozi CRM, Papras, Snifula, Ursnif
VTCollection     URLhaus      

2000 Ursnif aka Snifula
2006 Gozi v1.0, Gozi CRM, CRM, Papras
2010 Gozi v2.0, Gozi ISFB, ISFB, Pandemyia(*)
-> 2010 Gozi Prinimalka -> Vawtrak/Neverquest

In 2006, Gozi v1.0 ('Gozi CRM' aka 'CRM') aka Papras was first observed.
It was offered as a CaaS, known as 76Service. This first version of Gozi was developed by Nikita Kurmin, and he borrowed code from Ursnif aka Snifula, a spyware developed by Alexey Ivanov around 2000, and some other kits. Gozi v1.0 thus had a formgrabber module and often is classified as Ursnif aka Snifula.

In September 2010, the source code of a particular Gozi CRM dll version was leaked, which led to Vawtrak/Neverquest (in combination with Pony) via Gozi Prinimalka (a slightly modified Gozi v1.0) and Gozi v2.0 (aka 'Gozi ISFB' aka 'ISFB' aka Pandemyia). This version came with a webinject module.

References
2025-12-16 ⋅ R3dy's Blog ⋅ Paul Viard
Gozi Gozi Gozi - String Decryption
Gozi ISFB
2024-07-02 ⋅ Sekoia ⋅ Quentin Bourgue
Exposing FakeBat loader: distribution methods and adversary infrastructure
BlackCat Royal Ransom EugenLoader Carbanak Cobalt Strike DICELOADER Gozi IcedID Lumma Stealer NetSupportManager RAT Pikabot RedLine Stealer SectopRAT Sliver SmokeLoader Vidar
2023-12-20 ⋅ Viuleeenz ⋅ Alessandro Strino
Applied Emulation - Decrypting Ursnif strings with Unicorn
Gozi
2023-11-21 ⋅ IBM ⋅ Charlotte Hammond, Kat Metrick, Ole Villadsen
Stealthy WailingCrab Malware misuses MQTT Messaging Protocol
Gozi WikiLoader
2023-07-18 ⋅ Kostas TS ⋅ Kostas
Ursnif VS Italy: Il PDF del Destino
Gozi ISFB Snifula
2023-03-19 ⋅ 0xToxin Labs ⋅ @0xToxin
Gozi - Italian ShellCode Dance
Gozi ISFB
2023-03-14 ⋅ Viuleeenz ⋅ Alessandro Strino
Dynamic Binary Instrumentation for Malware Analysis
Gozi
2022-10-24 ⋅ Medium CSIS Techblog ⋅ Benoît Ancel
Chapter 1 — From Gozi to ISFB: The history of a mythical malware family.
Gozi ISFB Snifula
2022-05-09 ⋅ Microsoft ⋅ Microsoft 365 Defender Threat Intelligence Team, Microsoft Threat Intelligence Center (MSTIC)
Ransomware-as-a-service: Understanding the cybercrime gig economy and how to protect yourself
AnchorDNS BlackCat BlackMatter Conti DarkSide HelloKitty Hive LockBit REvil FAKEUPDATES Griffon ATOMSILO BazarBackdoor BlackCat BlackMatter Blister Cobalt Strike Conti DarkSide Emotet FiveHands Gozi HelloKitty Hive IcedID ISFB JSSLoader LockBit LockFile Maze NightSky Pandora Phobos Phoenix Locker PhotoLoader QakBot REvil Rook Ryuk SystemBC TrickBot WastedLocker BRONZE STARLIGHT
2022-05-09 ⋅ Microsoft Security ⋅ Microsoft 365 Defender Threat Intelligence Team, Microsoft Threat Intelligence Center
Ransomware-as-a-service: Understanding the cybercrime gig economy and how to protect yourself
Griffon BazarBackdoor BlackCat BlackMatter Blister Gozi LockBit Pandora Rook SystemBC TrickBot
2021-09-03 ⋅ Trend Micro ⋅ Mohamad Mokbel
The State of SSL/TLS Certificate Usage in Malware C&C Communications
AdWind ostap AsyncRAT BazarBackdoor BitRAT Buer Chthonic CloudEyE Cobalt Strike DCRat Dridex FindPOS GootKit Gozi IcedID ISFB Nanocore RAT Orcus RAT PandaBanker Qadars QakBot Quasar RAT Rockloader ServHelper Shifu SManager TorrentLocker TrickBot Vawtrak Zeus Zloader
2021-06-30 ⋅ The Record ⋅ Catalin Cimpanu
Gozi malware gang member arrested in Colombia
Gozi ISFB
2021-05-26 ⋅ DeepInstinct ⋅ Ron Ben Yizhak
A Deep Dive into Packing Software CryptOne
Cobalt Strike Dridex Emotet Gozi ISFB Mailto QakBot SmokeLoader WastedLocker Zloader
2021-03-31 ⋅ Kaspersky SAS ⋅ Kaspersky
Financial Cyberthreats in 2020
BetaBot DanaBot Emotet Gozi Ramnit RTM SpyEye TrickBot Zeus
2021-01-22 ⋅ Thomas Barabosch
The malware analyst’s guide to PE timestamps
Azorult Gozi IcedID ISFB LOLSnif SUNBURST TEARDROP
2020-12-21 ⋅ Cisco Talos ⋅ JON MUNSHAW
2020: The year in malware
WolfRAT Prometei Poet RAT Agent Tesla Astaroth Ave Maria CRAT Emotet Gozi IndigoDrop JhoneRAT Nanocore RAT NjRAT Oblique RAT SmokeLoader StrongPity WastedLocker Zloader
2020-08-09 ⋅ F5 Labs ⋅ Debbie Walkowski, Remi Cohen
Banking Trojans: A Reference Guide to the Malware Family Tree
BackSwap Carberp Citadel DanaBot Dridex Dyre Emotet Gozi Kronos PandaBanker Ramnit Shylock SpyEye Tinba TrickBot Vawtrak Zeus
2020-05-07 ⋅ Github (mlodic) ⋅ Matteo Lodi
Ursnif beacon decryptor
Gozi ISFB
2020-01-01 ⋅ Secureworks ⋅ SecureWorks
GOLD SWATHMORE
GlobeImposter Gozi IcedID TrickBot LUNAR SPIDER
2017-05-29 ⋅ Lokalhost.pl ⋅ Maciej Kotowicz
Gozi Tree
DreamBot Gozi ISFB Powersniff
2017-02-15 ⋅ Palo Alto Networks Unit 42 ⋅ Kaoru Hayashi
Banking Trojans: Ursnif Global Distribution Networks Identified
Gozi
2016-11-23 ⋅ G Data ⋅ G Data
Analysis: Ursnif - spying on your data since 2007
Gozi
2013-02-03 ⋅ Malware Must Die! ⋅ Malware Must Die!
The infection of Styx Exploit Kit (Landing page: painterinvoice.ru + Payload: PWS/Ursnif Variant)
Gozi
2007-03-20 ⋅ Secureworks ⋅ Don Jackson
Gozi Trojan
Gozi
Yara Rules
[TLP:WHITE] win_gozi_auto (20260917 | Detects win.gozi.)
rule win_gozi_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.gozi."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gozi"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { e8???????? 8b4df4 57 50 e8???????? }
            // n = 5, score = 100
            //   e8????????           |                     
            //   8b4df4               | mov                 ecx, dword ptr [ebp - 0xc]
            //   57                   | push                edi
            //   50                   | push                eax
            //   e8????????           |                     

        $sequence_1 = { 7502 eb20 8d458c 50 }
            // n = 4, score = 100
            //   7502                 | jne                 4
            //   eb20                 | jmp                 0x22
            //   8d458c               | lea                 eax, [ebp - 0x74]
            //   50                   | push                eax

        $sequence_2 = { 8c6a38 55 f79bfe7ca80d a7 }
            // n = 4, score = 100
            //   8c6a38               | mov                 word ptr [edx + 0x38], gs
            //   55                   | push                ebp
            //   f79bfe7ca80d         | neg                 dword ptr [ebx + 0xda87cfe]
            //   a7                   | cmpsd               dword ptr [esi], dword ptr es:[edi]

        $sequence_3 = { 86f2 8af4 8af4 86d6 0fadce }
            // n = 5, score = 100
            //   86f2                 | xchg                dl, dh
            //   8af4                 | mov                 dh, ah
            //   8af4                 | mov                 dh, ah
            //   86d6                 | xchg                dh, dl
            //   0fadce               | shrd                esi, ecx, cl

        $sequence_4 = { 57 56 ff7528 ff7524 }
            // n = 4, score = 100
            //   57                   | push                edi
            //   56                   | push                esi
            //   ff7528               | push                dword ptr [ebp + 0x28]
            //   ff7524               | push                dword ptr [ebp + 0x24]

        $sequence_5 = { c808bf35 6963c03caff3da c9 50 0c73 }
            // n = 5, score = 100
            //   c808bf35             | enter               -0x40f8, 0x35
            //   6963c03caff3da       | imul                esp, dword ptr [ebx - 0x40], 0xdaf3af3c
            //   c9                   | leave               
            //   50                   | push                eax
            //   0c73                 | or                  al, 0x73

        $sequence_6 = { e9???????? 395dec 0f8415010000 c745fc02000000 c745f801000000 e9???????? }
            // n = 6, score = 100
            //   e9????????           |                     
            //   395dec               | cmp                 dword ptr [ebp - 0x14], ebx
            //   0f8415010000         | je                  0x11b
            //   c745fc02000000       | mov                 dword ptr [ebp - 4], 2
            //   c745f801000000       | mov                 dword ptr [ebp - 8], 1
            //   e9????????           |                     

        $sequence_7 = { 894514 c745f000000000 8b4df8 e8???????? }
            // n = 4, score = 100
            //   894514               | mov                 dword ptr [ebp + 0x14], eax
            //   c745f000000000       | mov                 dword ptr [ebp - 0x10], 0
            //   8b4df8               | mov                 ecx, dword ptr [ebp - 8]
            //   e8????????           |                     

        $sequence_8 = { 85729b 7a47 43 c571d5 136ddf }
            // n = 5, score = 100
            //   85729b               | test                dword ptr [edx - 0x65], esi
            //   7a47                 | jp                  0x49
            //   43                   | inc                 ebx
            //   c571d5               | lds                 esi, ptr [ecx - 0x2b]
            //   136ddf               | adc                 ebp, dword ptr [ebp - 0x21]

        $sequence_9 = { 4a 0fbdd5 0fc0d6 8af4 0fb3ce 80ee96 }
            // n = 6, score = 100
            //   4a                   | dec                 edx
            //   0fbdd5               | bsr                 edx, ebp
            //   0fc0d6               | xadd                dh, dl
            //   8af4                 | mov                 dh, ah
            //   0fb3ce               | btr                 esi, ecx
            //   80ee96               | sub                 dh, 0x96

        $sequence_10 = { e9???????? ff75d8 ff7514 8d87f2030000 ff10 0bc0 }
            // n = 6, score = 100
            //   e9????????           |                     
            //   ff75d8               | push                dword ptr [ebp - 0x28]
            //   ff7514               | push                dword ptr [ebp + 0x14]
            //   8d87f2030000         | lea                 eax, [edi + 0x3f2]
            //   ff10                 | call                dword ptr [eax]
            //   0bc0                 | or                  eax, eax

        $sequence_11 = { e8???????? 8985b4feffff 56 6a02 ffd0 8bf0 8975e4 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   8985b4feffff         | mov                 dword ptr [ebp - 0x14c], eax
            //   56                   | push                esi
            //   6a02                 | push                2
            //   ffd0                 | call                eax
            //   8bf0                 | mov                 esi, eax
            //   8975e4               | mov                 dword ptr [ebp - 0x1c], esi

        $sequence_12 = { 8bc7 8bd6 7e14 6a00 50 52 e8???????? }
            // n = 7, score = 100
            //   8bc7                 | mov                 eax, edi
            //   8bd6                 | mov                 edx, esi
            //   7e14                 | jle                 0x16
            //   6a00                 | push                0
            //   50                   | push                eax
            //   52                   | push                edx
            //   e8????????           |                     

        $sequence_13 = { 59 898540ffffff 894658 33ff 89bd3cffffff 3b7e54 }
            // n = 6, score = 100
            //   59                   | pop                 ecx
            //   898540ffffff         | mov                 dword ptr [ebp - 0xc0], eax
            //   894658               | mov                 dword ptr [esi + 0x58], eax
            //   33ff                 | xor                 edi, edi
            //   89bd3cffffff         | mov                 dword ptr [ebp - 0xc4], edi
            //   3b7e54               | cmp                 edi, dword ptr [esi + 0x54]

        $sequence_14 = { 45 43 6f 6d 7061 63743200 c808bf35 }
            // n = 7, score = 100
            //   45                   | inc                 ebp
            //   43                   | inc                 ebx
            //   6f                   | outsd               dx, dword ptr [esi]
            //   6d                   | insd                dword ptr es:[edi], dx
            //   7061                 | jo                  0x63
            //   63743200             | arpl                word ptr [edx + esi], si
            //   c808bf35             | enter               -0x40f8, 0x35

        $sequence_15 = { ff7514 ff7510 ff750c ff7508 8d8715050000 ff10 }
            // n = 6, score = 100
            //   ff7514               | push                dword ptr [ebp + 0x14]
            //   ff7510               | push                dword ptr [ebp + 0x10]
            //   ff750c               | push                dword ptr [ebp + 0xc]
            //   ff7508               | push                dword ptr [ebp + 8]
            //   8d8715050000         | lea                 eax, [edi + 0x515]
            //   ff10                 | call                dword ptr [eax]

        $sequence_16 = { 0f87b1030000 ff24bd410f4300 8b41e4 3b42e4 7478 0fb642e4 }
            // n = 6, score = 100
            //   0f87b1030000         | ja                  0x3b7
            //   ff24bd410f4300       | jmp                 dword ptr [edi*4 + 0x430f41]
            //   8b41e4               | mov                 eax, dword ptr [ecx - 0x1c]
            //   3b42e4               | cmp                 eax, dword ptr [edx - 0x1c]
            //   7478                 | je                  0x7a
            //   0fb642e4             | movzx               eax, byte ptr [edx - 0x1c]

        $sequence_17 = { ff7618 8f461c 8b13 8b12 }
            // n = 4, score = 100
            //   ff7618               | push                dword ptr [esi + 0x18]
            //   8f461c               | pop                 dword ptr [esi + 0x1c]
            //   8b13                 | mov                 edx, dword ptr [ebx]
            //   8b12                 | mov                 edx, dword ptr [edx]

        $sequence_18 = { b87e8da638 e022 3a56b9 036890 2b02 9a102a6715fb53 }
            // n = 6, score = 100
            //   b87e8da638           | mov                 eax, 0x38a68d7e
            //   e022                 | loopne              0x24
            //   3a56b9               | cmp                 dl, byte ptr [esi - 0x47]
            //   036890               | add                 ebp, dword ptr [eax - 0x70]
            //   2b02                 | sub                 eax, dword ptr [edx]
            //   9a102a6715fb53       | lcall               0x53fb:0x15672a10

        $sequence_19 = { 8bf0 8b450c 8b4010 83660c00 894604 }
            // n = 5, score = 100
            //   8bf0                 | mov                 esi, eax
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]
            //   8b4010               | mov                 eax, dword ptr [eax + 0x10]
            //   83660c00             | and                 dword ptr [esi + 0xc], 0
            //   894604               | mov                 dword ptr [esi + 4], eax

        $sequence_20 = { 3bc6 7407 c745d801000000 834dfcff e8???????? 8b45d8 }
            // n = 6, score = 100
            //   3bc6                 | cmp                 eax, esi
            //   7407                 | je                  9
            //   c745d801000000       | mov                 dword ptr [ebp - 0x28], 1
            //   834dfcff             | or                  dword ptr [ebp - 4], 0xffffffff
            //   e8????????           |                     
            //   8b45d8               | mov                 eax, dword ptr [ebp - 0x28]

        $sequence_21 = { 6af4 dbe9 68912b4384 2383e08985e4 0572b6e2f4 fd }
            // n = 6, score = 100
            //   6af4                 | push                -0xc
            //   dbe9                 | fucomi              st(1)
            //   68912b4384           | push                0x84432b91
            //   2383e08985e4         | and                 eax, dword ptr [ebx - 0x1b7a7620]
            //   0572b6e2f4           | add                 eax, 0xf4e2b672
            //   fd                   | std                 

        $sequence_22 = { de7e75 cd18 4a 51 d2b8c512294e }
            // n = 5, score = 100
            //   de7e75               | fidivr              word ptr [esi + 0x75]
            //   cd18                 | int                 0x18
            //   4a                   | dec                 edx
            //   51                   | push                ecx
            //   d2b8c512294e         | sar                 byte ptr [eax + 0x4e2912c5], cl

        $sequence_23 = { c7400402000000 e9???????? 817df800001000 7607 c745f800001000 }
            // n = 5, score = 100
            //   c7400402000000       | mov                 dword ptr [eax + 4], 2
            //   e9????????           |                     
            //   817df800001000       | cmp                 dword ptr [ebp - 8], 0x100000
            //   7607                 | jbe                 9
            //   c745f800001000       | mov                 dword ptr [ebp - 8], 0x100000

        $sequence_24 = { 0fbaf24a 0fb3ce 0faff1 8b0d???????? 8b15???????? 6a00 }
            // n = 6, score = 100
            //   0fbaf24a             | btr                 edx, 0x4a
            //   0fb3ce               | btr                 esi, ecx
            //   0faff1               | imul                esi, ecx
            //   8b0d????????         |                     
            //   8b15????????         |                     
            //   6a00                 | push                0

        $sequence_25 = { 897508 89750c 895d10 895d14 ff15???????? 3bc6 }
            // n = 6, score = 100
            //   897508               | mov                 dword ptr [ebp + 8], esi
            //   89750c               | mov                 dword ptr [ebp + 0xc], esi
            //   895d10               | mov                 dword ptr [ebp + 0x10], ebx
            //   895d14               | mov                 dword ptr [ebp + 0x14], ebx
            //   ff15????????         |                     
            //   3bc6                 | cmp                 eax, esi

        $sequence_26 = { e8???????? 6a00 8d879a040000 50 ff750c e8???????? }
            // n = 6, score = 100
            //   e8????????           |                     
            //   6a00                 | push                0
            //   8d879a040000         | lea                 eax, [edi + 0x49a]
            //   50                   | push                eax
            //   ff750c               | push                dword ptr [ebp + 0xc]
            //   e8????????           |                     

        $sequence_27 = { be84f7c34f 10ba810b7f57 a4 8c6a38 55 }
            // n = 5, score = 100
            //   be84f7c34f           | mov                 esi, 0x4fc3f784
            //   10ba810b7f57         | adc                 byte ptr [edx + 0x577f0b81], bh
            //   a4                   | movsb               byte ptr es:[edi], byte ptr [esi]
            //   8c6a38               | mov                 word ptr [edx + 0x38], gs
            //   55                   | push                ebp

        $sequence_28 = { ff15???????? 85c0 740e 834dfcff 33c0 }
            // n = 5, score = 100
            //   ff15????????         |                     
            //   85c0                 | test                eax, eax
            //   740e                 | je                  0x10
            //   834dfcff             | or                  dword ptr [ebp - 4], 0xffffffff
            //   33c0                 | xor                 eax, eax

        $sequence_29 = { 894db8 8b55b8 8955e0 c745fc00000000 }
            // n = 4, score = 100
            //   894db8               | mov                 dword ptr [ebp - 0x48], ecx
            //   8b55b8               | mov                 edx, dword ptr [ebp - 0x48]
            //   8955e0               | mov                 dword ptr [ebp - 0x20], edx
            //   c745fc00000000       | mov                 dword ptr [ebp - 4], 0

        $sequence_30 = { 8995c4fbffff 8b95c0fbffff 0b95c4fbffff 7431 feca }
            // n = 5, score = 100
            //   8995c4fbffff         | mov                 dword ptr [ebp - 0x43c], edx
            //   8b95c0fbffff         | mov                 edx, dword ptr [ebp - 0x440]
            //   0b95c4fbffff         | or                  edx, dword ptr [ebp - 0x43c]
            //   7431                 | je                  0x33
            //   feca                 | dec                 dl

        $sequence_31 = { b282 4e f6de c0ee16 0fb3ea }
            // n = 5, score = 100
            //   b282                 | mov                 dl, 0x82
            //   4e                   | dec                 esi
            //   f6de                 | neg                 dh
            //   c0ee16               | shr                 dh, 0x16
            //   0fb3ea               | btr                 edx, ebp

    condition:
        7 of them and filesize < 568320
}
Download all Yara Rules