Overview

overview

10

Static

static

a8a24bfdf5...3a.exe

windows7_x64

10

a8a24bfdf5...3a.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a8a24bfdf5de4000030be38cc90e3e24e9f215e87a351b6d80825bd9781fe23a.exe

  • Size

    149KB

  • Sample

    201109-ftamntydk2

  • MD5

    6ceb3ccf75e4da807c3e145335777ab0

  • SHA1

    4f1fda8c8279acb1daf629a790ea26d363e0317b

  • SHA256

    a7ccb16be21a4545df6e4edc1574b36a3c209fe040243bd70aec35b031a4e9ac

  • SHA512

    6e92841bb34da468c592586fc15e38d72277089923d7fa0a7cd8d54210245277366fb8ccfd4fdd16310d87969d7276be7ffa2218a3a45cc58f4ad4b9fb71d831

Score
10/10
ursnif3475bankertrojan

Malware Config

Extracted

Family

ursnif

Botnet

3475

C2

google.com

gmail.com

q982yeq23.xyz

t7763jykqeiy.com

hjruu.com
rsa_pubkey.base64
serpent.plain

Targets

    • Target

      a8a24bfdf5de4000030be38cc90e3e24e9f215e87a351b6d80825bd9781fe23a.exe

    • Size

      149KB

    • MD5

      6ceb3ccf75e4da807c3e145335777ab0

    • SHA1

      4f1fda8c8279acb1daf629a790ea26d363e0317b

    • SHA256

      a7ccb16be21a4545df6e4edc1574b36a3c209fe040243bd70aec35b031a4e9ac

    • SHA512

      6e92841bb34da468c592586fc15e38d72277089923d7fa0a7cd8d54210245277366fb8ccfd4fdd16310d87969d7276be7ffa2218a3a45cc58f4ad4b9fb71d831

    Score
    10/10
    ursnif3475bankertrojan

    • Ursnif, Dreambot

      Ursnif is a variant of the Gozi IFSB with more capabilities.

      bankertrojanursnif
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks