Malware
Gozi
aka CRM · Gozi CRM · Papras · Snifula · Ursnif
2000 Ursnif aka Snifula 2006 Gozi v1.0, Gozi CRM, CRM, Papras 2010 Gozi v2.0, Gozi ISFB, ISFB, Pandemyia(*) -> 2010 Gozi Prinimalka -> Vawtrak/Neverquest In 2006, Gozi v1.0 ('Gozi CRM' aka 'CRM') aka
Gozi, also known as CRM, Gozi CRM, Papras, Snifula, is a Windows malware family.
Background
The Gozi lineage runs roughly as follows: 2000 Ursnif (aka Snifula); 2006 Gozi v1.0, Gozi CRM, CRM, Papras; 2010 Gozi v2.0, Gozi ISFB, ISFB, Pandemyia(*); and 2010 Gozi Prinimalka leading to Vawtrak/Neverquest.
Gozi v1.0 ('Gozi CRM' aka 'CRM') aka Papras first appeared in 2006, offered as a crimeware-as-a-service known as 76Service. Built by Nikita Kurmin, it reused code from Ursnif aka Snifula, a spyware Alexey Ivanov created around 2000, plus other kits; because of its formgrabber module it is frequently labeled as Ursnif aka Snifula.
When the source code of a specific Gozi CRM dll version leaked in September 2010, it gave rise (in combination with Pony) to Vawtrak/Neverquest by way of Gozi Prinimalka (a lightly altered Gozi v1.0) and Gozi v2.0 (aka 'Gozi ISFB' aka 'ISFB' aka Pandemyia), the latter introducing a webinject module.
Source: Malpedia (Fraunhofer FKIE).