Overview

overview

10

Static

static

10

dc75bc0a7a...36.dll

windows7_x64

1

dc75bc0a7a...36.dll

windows10-2004_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dc75bc0a7aad28d157e5315008fb682158298ff710ede2c6ebcf5cd28b4aad36

  • Size

    64KB

  • MD5

    c522850b1e78f5086200a969996d8f96

  • SHA1

    8e4af2380b0080e828ed8432bb1482390cb264e0

  • SHA256

    dc75bc0a7aad28d157e5315008fb682158298ff710ede2c6ebcf5cd28b4aad36

  • SHA512

    e53362c46a78c9104f8a58be469b929cfa7468fd4bd4cbb32ca6f2c0517861be27f9dd639446044f09113d3976da931bf1586d6b3b7b12cc1dc6694e6b0b540b

  • SSDEEP

    768:M2jWSTrUiN6X5vkckQHdegV6Vk69Le6zoEsFK6GyuXcHnKYxyi:M2CSTxEX8+dIB9LehKPc/

Score
10/10
8899gozi_ifsb

Malware Config

Extracted

Family

gozi_ifsb

Botnet

8899

C2

http://microsoft.com.login/

https://premiumweare.com

https://gloverunomai.com
Attributes
  • base_path

    /glik/

  • build

    260212

  • dga_season

    10

  • exe_type

    loader

  • extension

    .lwe

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

Files

  • dc75bc0a7aad28d157e5315008fb682158298ff710ede2c6ebcf5cd28b4aad36
    .dll regsvr32 windows x86


    Code Sign

    Headers

    Exports

    Sections