General

  • Target

    4.zip

  • Size

    29.8MB

  • MD5

    ce09fd86f48ca550598456136c3878df

  • SHA1

    3483bacb0ca5f7a36ddbf0a60268fa5b09bf4334

  • SHA256

    2214bdc78b558176a17484bcc02079a5470e0b49073d50d19b522d67dc4396e3

  • SHA512

    9277d9265eeadf617dec8a96faa2986cbc4354bbeabad544679f18b4537fba6c2c4889da51a538ccf0de5fa7717ab5e2e534476a5381dca268c3e3ba9a498d11

Malware Config

Extracted

Family

gozi_ifsb

Botnet

2500

C2

todo.faroin.at

apr.intoolkom.at

r23cirt55ysvtdvl.onion

kas.kargoapp.at

io.feen007.at

gtk.uploner.at

l46t3vgvmtx5wxe6.onion

pop.biopiof.at

free.monotreener.com

tb.yapker.at

app.flashgameo.at

Attributes
  • exe_type

    worker

  • server_id

    580

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi_ifsb family
  • Patched UPX-packed file 1 IoCs

    Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

Files

  • 4.zip
    .zip
  • 0f56c5738ae435abeac7a0928a5de2ff5d4082370c43f257a4c0589212f08901
    .elf linux arm
  • 219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0
    .exe windows x86


  • 2a0f53dd66eff57c82fcad2fff75d7ac63f6f4d764ec27fe862e6b3f01a21c03
    .exe windows x86


  • 36ef5e0db18469267810503ba4fd099e59007c3f10f718bccffdc93e87a853a0
    .exe windows x86


  • 4072fc745ae1b976bfff8fdfdebdac6db5e33bb4f63507b4d56ab67b98c6db65
    .exe windows x86


  • 42c8ded976a7c9f295888220d4d2fc273535f1fa15e6e25cfceaf454188f7895
    .exe windows x86


  • 52969fae09c2428c701a8b51a20c1eb07bab1bca79acb21eaa910d764533155d
    .rtf
  • 571de4698edff95c328d3521b11e800a3b9659ad55281dd7729b2ce2210ac931
    .exe windows x86


    Exports

  • 57bb59a2c491b89b3321428121ba1b5e88daca5a8e379fde41afc73e9679d752
    .rtf
  • 662fbe23c87844a881ca233876ff75ee05ddf2ac0a1b5546fb5bc7603474860a
    .exe windows x86


  • 70d5a71e821c8024fa2d5fb8a389390acc1289b88745fad61b6536cab0bd5191
    .dll windows x64


  • 71d384c258d0d2cfbeeda66a1ba67085b347d934a3484e0df3fc06a684085386
    .exe windows x86


  • 79745c2263c8abe5b916e39e577652c029b5b586e7ccb39ee63ed0fc1568c39d
    .exe windows x86


  • 83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3
    .exe windows x86


    Exports

  • 8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0
    .exe windows x86


  • a3feb5265e6d02710f04ff618e966e9da9ba8fc8dc5692d6f7633fe0a3037b66
    .exe windows x86


  • b1aa2c4b8aea86d296fb53aa4526c3e3d132f6a80b21334e5253fcdcc473a452
    .elf linux mipsel
  • b28811bb2049d77cf2c66e7f667ab4312d86b4e54e645d68ec9a0746f46e3bf7
    .exe windows x86


  • bc5d82859d4b7c567fa029977042a8e6629a2d1b3afa92b6f52a33d3006a068b
    .exe windows x86


  • c715f96c8313bb357821b1919217b2c0ff6fc5d2cd17991891673d7c14153604
    .elf linux arm
  • cb414e417f8f3de9392dbc6a89421d1a8e95beabbbe387e11771567d63a7b227
    .exe windows x86


  • cee432dc98ab16fe238a59c066bcff4e7345b793e918215e1b5c55defad2eabd
    .elf linux mipsbe
  • d9d63ec0992fc7234c2edf15653504a584e2de64251ee86654d7ef33691bcb7b
    .elf linux arm
  • deee0cbc7926b3bf60ae6071e6dc4233162cbfa125c649eb3979db7da100fa69
    .exe windows x86


  • df3dabd031184b67bab7043baaae17061c21939d725e751c0a6f6b7867d0cf34
    .exe windows x86


    Exports

  • df921413ee769ff2ad5476498aab7f443580c866bb787e9eac42fb7e90a0d4d6
    .lnk
  • e19e0e7f8871e7acf07a37b277b5aaf2aa125f28ee11644c335eb313ec768df5
    .exe windows x86


    Exports

  • e4d1670d1785eabdda12d45ee5c32c185863e1f3d049424a8c616a062659cb50
    .exe windows x86


    Exports

  • eb2a1f2067427229a3037c73914f2a978bd3a1ab074609fed5962e952db2a3c0
    .exe windows x86


  • f415487e104efb2d80000858f7942cd9db73526601066eca5e63d99a50926298
    .rtf
  • f6a377ba145a5503b5eb942d17645502eddf3a619d26a7b60df80a345917aaa2
  • ffe5b10cd81f4c1484f62863be69ea28732b8e765b12569c5cd11b463bd4d261
    .exe windows x86