General
-
Target
1853934af4566932a597db7d84ac15bba65ba7cc9976d331863da88ef9765a45
-
Size
562KB
-
Sample
220608-wbtk7saahk
-
MD5
1543c2e59eaa9ab65c935734108091b7
-
SHA1
68229a2c51461d047088bfb3f263dfdcf51d2b9f
-
SHA256
1853934af4566932a597db7d84ac15bba65ba7cc9976d331863da88ef9765a45
-
SHA512
a3dcbd026744d547a51c071bc827f3071c87601842f6097fb5df6315e9b204eadfcdff3ec987da6e0a76d61287bfb99adab8ef0bc98f83c200bd9052908d7ec8
Malware Config
Extracted
gozi_ifsb
-
build
217061
Extracted
gozi_ifsb
2000
intro.tir001.at/rpc
doa.quappak.at/rpc
api.siperskon.at/rpc
io.tir001.at/rpc
ytruieowphf.bit/rpc
u2.ceelop.at/rpc
enter.nokartoon.at/rpc
api.nwq2000.at/rpc
cd.iqwoker.at/rpc
api.fin150.at/rpc
chat.loop1000.at/rpc
chat.iqwoker.at/rpc
mahono.cn/rpc
-
build
217061
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
dns_servers
192.71.245.208
8.8.8.8
178.17.170.179
82.196.9.45
151.80.222.79
68.183.70.217
217.144.135.7
158.69.160.164
207.148.83.241
5.189.170.196
217.144.132.148
94.247.43.254
188.165.200.156
159.89.249.249
150.249.149.222
-
exe_type
loader
-
server_id
150
Targets
-
-
Target
1853934af4566932a597db7d84ac15bba65ba7cc9976d331863da88ef9765a45
-
Size
562KB
-
MD5
1543c2e59eaa9ab65c935734108091b7
-
SHA1
68229a2c51461d047088bfb3f263dfdcf51d2b9f
-
SHA256
1853934af4566932a597db7d84ac15bba65ba7cc9976d331863da88ef9765a45
-
SHA512
a3dcbd026744d547a51c071bc827f3071c87601842f6097fb5df6315e9b204eadfcdff3ec987da6e0a76d61287bfb99adab8ef0bc98f83c200bd9052908d7ec8
Score10/10-
Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
-