General

  • Target

    2d2fcc5fae9e4c2da5ff64f5d8a890e55429fe8655201eb0b22e92cba82c83b9

  • Size

    1.8MB

  • Sample

    220614-y1keyafdc9

  • MD5

    f3324233b35d21f703f74f6be55d71de

  • SHA1

    c544341e129f8fdf5064f3bd0ee5140a22396634

  • SHA256

    2d2fcc5fae9e4c2da5ff64f5d8a890e55429fe8655201eb0b22e92cba82c83b9

  • SHA512

    5938038bd304469706dde1479f552e5ffd5f609d25544aafd76fe9e49af6be3d56af6adc242d52877754df5f29a6e04d1d0b828614ba9646098ce8d1357ee539

Malware Config

Extracted

Family

gozi_ifsb

Attributes
  • build

    214062

Extracted

Family

gozi_ifsb

Botnet

3184

C2

qfelicialew.city

mzg4958lc.com

gxuxwnszau.band

Attributes
  • build

    214062

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      2d2fcc5fae9e4c2da5ff64f5d8a890e55429fe8655201eb0b22e92cba82c83b9

    • Size

      1.8MB

    • MD5

      f3324233b35d21f703f74f6be55d71de

    • SHA1

      c544341e129f8fdf5064f3bd0ee5140a22396634

    • SHA256

      2d2fcc5fae9e4c2da5ff64f5d8a890e55429fe8655201eb0b22e92cba82c83b9

    • SHA512

      5938038bd304469706dde1479f552e5ffd5f609d25544aafd76fe9e49af6be3d56af6adc242d52877754df5f29a6e04d1d0b828614ba9646098ce8d1357ee539

MITRE ATT&CK Matrix

Tasks