Overview

overview

10

Static

static

9

e17dd6e10b...b0.exe

windows7_x64

10

e17dd6e10b...b0.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e17dd6e10b76f9d0987b3fbd91504a4a94c30712f6d1a677eb13886becbcceb0

  • Size

    109KB

  • Sample

    220521-p58tnagga3

  • MD5

    776407ef671c10897da7093a079ff8be

  • SHA1

    7baa088a928ac6f9cc8d9869e7efe04e3e07d0a9

  • SHA256

    e17dd6e10b76f9d0987b3fbd91504a4a94c30712f6d1a677eb13886becbcceb0

  • SHA512

    5da155e85b26fe98070e3b87888e645a53a4a6705f13f53f1af3a0736181621f8fba2e995f035a0f4b955bab661954d18d51c6ba0ad032c46b24eaf36693fa6d

Score
10/10
gozi_rm3202004061bankercryptonepackertrojan

Malware Config

Extracted

Family

gozi_rm3

Attributes
  • build

    300854

Extracted

Family

gozi_rm3

Botnet

202004061

C2

https://dropshipbear.xyz

Attributes
  • build

    300854

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

  • url_path

    index.htm

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      e17dd6e10b76f9d0987b3fbd91504a4a94c30712f6d1a677eb13886becbcceb0

    • Size

      109KB

    • MD5

      776407ef671c10897da7093a079ff8be

    • SHA1

      7baa088a928ac6f9cc8d9869e7efe04e3e07d0a9

    • SHA256

      e17dd6e10b76f9d0987b3fbd91504a4a94c30712f6d1a677eb13886becbcceb0

    • SHA512

      5da155e85b26fe98070e3b87888e645a53a4a6705f13f53f1af3a0736181621f8fba2e995f035a0f4b955bab661954d18d51c6ba0ad032c46b24eaf36693fa6d

    Score
    10/10
    gozi_rm3202004061bankertrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks