General

  • Target

    2c8c150f5c788e824d0556e8ed1263ce21ad8dad522fa390db8105117915a486

  • Size

    372KB

  • Sample

    220614-2cw1lsfhdr

  • MD5

    14cd75d4e9dd6686e024be064952fa2c

  • SHA1

    3c186fced3d4a9f3910bb5362ec8f5fb264c5ba4

  • SHA256

    2c8c150f5c788e824d0556e8ed1263ce21ad8dad522fa390db8105117915a486

  • SHA512

    b8f9ac3e3793486bb2109a695fce618d35aa5227f44e91faa75870ceda8b97b4e85f04bd3352bc0d3e7b00c8d785ca2f9f876f0dcf01b4002e1bb3e25c33e8df

Malware Config

Extracted

Family

gozi_ifsb

Attributes
  • build

    214062

Extracted

Family

gozi_ifsb

Botnet

3181

C2

bm25yp.com

xiivhaaou.email

m264591jasen.city

Attributes
  • build

    214062

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      2c8c150f5c788e824d0556e8ed1263ce21ad8dad522fa390db8105117915a486

    • Size

      372KB

    • MD5

      14cd75d4e9dd6686e024be064952fa2c

    • SHA1

      3c186fced3d4a9f3910bb5362ec8f5fb264c5ba4

    • SHA256

      2c8c150f5c788e824d0556e8ed1263ce21ad8dad522fa390db8105117915a486

    • SHA512

      b8f9ac3e3793486bb2109a695fce618d35aa5227f44e91faa75870ceda8b97b4e85f04bd3352bc0d3e7b00c8d785ca2f9f876f0dcf01b4002e1bb3e25c33e8df

MITRE ATT&CK Matrix

Tasks