Overview

overview

10

Static

static

54ea3470b7...f9.dll

windows7_x64

10

54ea3470b7...f9.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    54ea3470b7b6a4653c7253a874118971b842c3d38dcca7f65f3ec4446b63dff9

  • Size

    456KB

  • Sample

    220319-kxdlbseghn

  • MD5

    25a65068db29d21f15626ed5a89f0940

  • SHA1

    047f91c8f3cd95a0b5dbfc402607f73a96943730

  • SHA256

    54ea3470b7b6a4653c7253a874118971b842c3d38dcca7f65f3ec4446b63dff9

  • SHA512

    1f06b0a9105821470d1ed7444ec769e2448f00d269adf4bc4942295787b154e0baee48f6a22e8687f4a06307e33c5829035558b4ea331b62a49d31400d47741e

Score
10/10
gozi_ifsb1100bankertrojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

1100

C2

golang.feel500.at/api1

api10.laptok.at/api1
Attributes
  • build

    250171

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    730

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      54ea3470b7b6a4653c7253a874118971b842c3d38dcca7f65f3ec4446b63dff9

    • Size

      456KB

    • MD5

      25a65068db29d21f15626ed5a89f0940

    • SHA1

      047f91c8f3cd95a0b5dbfc402607f73a96943730

    • SHA256

      54ea3470b7b6a4653c7253a874118971b842c3d38dcca7f65f3ec4446b63dff9

    • SHA512

      1f06b0a9105821470d1ed7444ec769e2448f00d269adf4bc4942295787b154e0baee48f6a22e8687f4a06307e33c5829035558b4ea331b62a49d31400d47741e

    Score
    10/10
    gozi_ifsb1100bankertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks