Overview

overview

10

Static

static

10

0255095f74...9f.dll

windows7_x64

1

0255095f74...9f.dll

windows10-2004_x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    0255095f742b68b65c801d2c6cb71a314521b8586803176ab6e540b2376f899f
  • Size 448KB
  • Sample220201-m5dmeadchn
  • SHA256 0255095f742b68b65c801d2c6cb71a314521b8586803176ab6e540b2376f899f
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
3322gozi_ifsb

Malware Config

Extracted

Family

  • gozi_ifsb

Botnet

  • 3322

C2

  • signin.microsoft.com

  • login.microsoft.com

  • interwind.co

  • telewind.co

Attributes
  • base_path

    /brooklin/

  • build

    250187

  • dns_servers

    107.174.86.134

    107.175.127.22

  • exe_type

    loader

  • extension

    .dwg

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

File Explorer

  • 0255095f742b68b65c801d2c6cb71a314521b8586803176ab6e540b2376f899f
    .dll 448KB

0255095f742b68b65c801d2c6cb71a314521b8586803176ab6e540b2376f899f

  • IMPHASH 9b4bd5e9c744a772e2cae4b95c84d26f
  • SHA256 0255095f742b68b65c801d2c6cb71a314521b8586803176ab6e540b2376f899f
  • MD5 SHA1 SHA512 SSDEEP
regsvr32windowsx86
Minor OS version
Major OS version
Entry point
6906
Magic Number
267
Subsystem
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE
PDB paths