General
-
Target
22f3a20f7ce8a85a10f4de1b259fb71c6d219859274fa82add250fa3000e466c
-
Size
314KB
-
Sample
220612-dtzaascadj
-
MD5
eba1bb77d02a7e1de87f577dab239d93
-
SHA1
5ad4d40f6029630cadaf75848570677905227cc0
-
SHA256
22f3a20f7ce8a85a10f4de1b259fb71c6d219859274fa82add250fa3000e466c
-
SHA512
1673b08382a8feba372e06a75083fe82f8eddfcfef09221985f2d6fb84f198df90f8c987c4a1e23a629768a75a533193de11b5b5c21df33ab0aa811a9eada0af
Malware Config
Extracted
gozi_ifsb
2000
g2.ex100p.at/webstore
beetfeetlife.bit/webstore
a1.mafinlop.at/webstore
ax.ikobut.at/webstore
xc.ahhanot.at/webstore
extra.avareg.cn/webstore
api.ex100p.at/webstore
foo.avaregio.at/webstore
op.hopkeen.at/webstore
f1.cnboal.at/webstore
xxx.derlop.at/webstore
core.cnboal.at/webstore
pop.mangobal.at/webstore
-
build
217061
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
dns_servers
192.71.245.208
8.8.8.8
178.17.170.179
82.196.9.45
151.80.222.79
68.183.70.217
217.144.135.7
158.69.160.164
207.148.83.241
5.189.170.196
217.144.132.148
94.247.43.254
188.165.200.156
159.89.249.249
150.249.149.222
-
exe_type
loader
-
server_id
550
Targets
-
-
Target
22f3a20f7ce8a85a10f4de1b259fb71c6d219859274fa82add250fa3000e466c
-
Size
314KB
-
MD5
eba1bb77d02a7e1de87f577dab239d93
-
SHA1
5ad4d40f6029630cadaf75848570677905227cc0
-
SHA256
22f3a20f7ce8a85a10f4de1b259fb71c6d219859274fa82add250fa3000e466c
-
SHA512
1673b08382a8feba372e06a75083fe82f8eddfcfef09221985f2d6fb84f198df90f8c987c4a1e23a629768a75a533193de11b5b5c21df33ab0aa811a9eada0af
Score10/10-
Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
-