Overview

overview

10

Static

static

10

0d655192f9...83.dll

windows7_x64

1

0d655192f9...83.dll

windows10-2004_x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    0d655192f947027ebe2d4bcef991493011cadd6b5c355b592cf8606e56eb7c83
  • Size 45KB
  • Sample220201-m14b9sdcdr
  • SHA256 0d655192f947027ebe2d4bcef991493011cadd6b5c355b592cf8606e56eb7c83
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
1000gozi_ifsb

Malware Config

Extracted

Family

  • gozi_ifsb

Botnet

  • 1000

C2

  • doom.matr.at/rpc

  • tri.umpalok.at/rpc

  • tt.zicino.at/rpc

  • ut.nonpur.at/rpc

  • app.xenope.at/rpc

  • u2.miutor.at/rpc

  • io.tir001.at/rpc

  • m.umpalok.at/rpc

  • sq.upstor.at/rpc

  • a1.umpalok.at/rpc

  • api.reg100.at/rpc

  • qqq.matr.at/rpc

  • cd.qwoker.at/rpc

  • chat.engstol.at/rpc

  • mahono.cn/rpc

  • win.zicino.at/rpc

  • w5.xenope.at/rpc

Attributes
  • build

    217038

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    150

rsa_pubkey.plain
serpent.plain

Signatures

File Explorer

  • 0d655192f947027ebe2d4bcef991493011cadd6b5c355b592cf8606e56eb7c83
    .dll 45KB

0d655192f947027ebe2d4bcef991493011cadd6b5c355b592cf8606e56eb7c83

  • IMPHASH eaa062905dfe1db9c2f5d6f0d7cefd1a
  • SHA256 0d655192f947027ebe2d4bcef991493011cadd6b5c355b592cf8606e56eb7c83
  • MD5 SHA1 SHA512 SSDEEP
windowsx86
Minor OS version
Major OS version
Entry point
4345
Magic Number
267
Subsystem
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE
PDB paths