nuclei-templates/ssl/c2/gozi-malware-c2.yaml

28 lines
1.1 KiB
YAML

id: gozi-malware-c2
info:
name: Gozi Malware C2 - Detect
author: pussycat0x
severity: info
description: |
Gozi is a banking Trojan that has been modified to include new obfuscation techniques, to evade detection. Previous breaches involving Gozi in the healthcare sector led to the compromise of data associated with 3.7 million patients costing $5.55 million.
reference: |
https://github.com/thehappydinoa/awesome-censys-queries#gozi-malware--
metadata:
verified: "true"
max-request: 1
censys-query: 'services.tls.certificates.leaf_data.issuer_dn: "C=XX, ST=1, L=1, O=1, OU=1, CN=\*"'
tags: ssl,tls,c2,ir,osint,malware,gozi
ssl:
- address: "{{Host}}:{{Port}}"
matchers:
- type: word
part: issuer_dn
words:
- "CN=*, OU=1, O=1, L=1, ST=1, C=XX"
extractors:
- type: json
json:
- ".issuer_dn"
# digest: 490a00463044022001e1151a6ce0a00eb9f95c860b51c8cc04fc23945f9bebc12f404a6bf61fd5ad02206e322fe21b3a16f088907e7350b069ec01faf01220a38894e71e931950b38c63:922c64590222798bb761d5b6d8e72950