General
-
Target
8e54a89fc59683cee86de964ec475dea9fc5618b.zip
-
Size
135KB
-
Sample
211021-lmhyqsaba5
-
MD5
7f5f7a43ba27f8825f6744559169f113
-
SHA1
b8dae9800fbde147c9705377670897e806c6abdb
-
SHA256
154fcf6de1a4d2148da99d796d7c611b10d894546610561b588a970ab7c7053f
-
SHA512
1ec967ad2db08d47ed43d299fed52abd9696f045c13a7e92e5911ae5c1b281b49803e7e75d272515fc2c67aafc5525f477aa82fbf26a3caeb16b3c3bab7e8990
Malware Config
Extracted
gozi_ifsb
-
build
214082
Extracted
gozi_ifsb
3400
microsoft.com
update.microsoft.com
avast.com
tm90daron.club
jamericohermann.com
b9437ariane.com
-
build
214082
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
loader
-
server_id
12
Targets
-
-
Target
5e7740afdd5c5865a2304e2f7c5fc3f1cd1016f503a4b1752923f44059fd1a57
-
Size
208KB
-
MD5
35e3868c7d28d2ed87248077f670c707
-
SHA1
8e54a89fc59683cee86de964ec475dea9fc5618b
-
SHA256
5e7740afdd5c5865a2304e2f7c5fc3f1cd1016f503a4b1752923f44059fd1a57
-
SHA512
c8bbf7d192aff6c45005700014a22ea72832febc73b16ae925b339a356815b27bea3252917a9aa94e48fc05377b85bd1206f33c7e46fb17bdf325aff7ef40e37
Score10/10-
Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
-