Overview

overview

10

Static

static

ef78d1bc08...ba.exe

windows7_x64

10

ef78d1bc08...ba.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    ef78d1bc0863a7e939b37e2daefe96450cd44e207d52e8663030fb1780eea7ba
  • Size 126KB
  • Sample220320-dypawsgab3
  • SHA256 ef78d1bc0863a7e939b37e2daefe96450cd44e207d52e8663030fb1780eea7ba
  • MD5 SHA1 SHA512
Score
10/10
gozi_ifsb1051bankertrojan

Malware Config

Extracted

Family

  • gozi_ifsb

Botnet

  • 1051

C2

  • c.s-microsoft.com

  • ajax.googleapis.com

  • vlasdmkdmewnfjfnd.xyz

Attributes
  • build

    250166

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • dns_servers

    107.174.86.134

    107.175.127.22

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target
      ef78d1bc0863a7e939b37e2daefe96450cd44e207d52e8663030fb1780eea7ba
    • Size 126KB
    • SHA256 ef78d1bc0863a7e939b37e2daefe96450cd44e207d52e8663030fb1780eea7ba
    • MD5 SHA1 SHA512
    Score
    10/10
    gozi_ifsb1051bankertrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks