General

  • Target

    gozi.payload-disk

  • Size

    43KB

  • MD5

    d1a3c115a2cee09715572c7ee70451b1

  • SHA1

    44d4963140af2515e2884b3e8077fed446e01438

  • SHA256

    4d34a7f79a78d18656167c38f4fb33d5e9a3e233e84a2238f2d0f6df208b52fa

  • SHA512

    324baffb400377b53893488d1db31f28d4549b6086909e2c8f91010648cd424d7d51db4a78bdfd1286b51978e7b7c603a39828b2036c42c578c984f1f7e89ab5

Score
10/10

Malware Config

Extracted

Family

gozi_ifsb

Botnet

7627

C2

vilogerta.top

linkspremium.ru

premiumlists.ru

Attributes
  • base_path

    /drew/

  • build

    250225

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • gozi.payload-disk
    .dll windows x86

    0d41e840891676bdaee3e54973cf5a69


    Code Sign

    Headers

    Imports

    Sections