Overview

overview

10

Static

static

10

305f263432...bd.dll

windows7_x64

10

305f263432...bd.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    305f2634325220221d799665a2386f67236f6602158b0ff4957b6a8c5a90f4bd

  • Size

    186KB

  • MD5

    6fcf9b1fea714dfc586bbe8bf638c2a4

  • SHA1

    5307be00240a539c135116931f1a003124dd13ab

  • SHA256

    305f2634325220221d799665a2386f67236f6602158b0ff4957b6a8c5a90f4bd

  • SHA512

    468d0069c4fdf2759043663443453eb590355d99dd58a16041fd0095ff8cfd0bfea9ad52aaed89e621753de751e046141e125571b8180bdfc68f01cc6495ad98

  • SSDEEP

    3072:cA36vaKOnDW0mmHeQMZb85xPLs7zEVoCHVIrsD3WG6Lu2qlalXn6WisGacve89jQ:cA3gaK4DHAZb8vs7zIoCGrsbqu2qlal5

Score
10/10
2000gozi_ifsb

Malware Config

Extracted

Family

gozi_ifsb

Botnet

2000

C2

api2.doter.at/webstore

beetfeetlife.bit/webstore

in.extermas.at/webstore

d6djf2vtjv5kowow.onion/webstore

asx.zaronif.at/webstore

g2.ex100p.at/webstore

gif.doter.at/webstore

extra.avareg.cn/webstore

vo5vuw5tdkqetax4.onion/webstore

foo.avaregio.at/webstore

op.iovbased.at/webstore

ws.doter.at/webstore

f1.cnboal.at/webstore

zq4aggr2i6hmklgd.onion/webstore

xxx.doolap.at/webstore
Attributes
  • build

    217050

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • dns_servers

    51.255.48.78

    8.8.8.8

    192.71.245.208

    178.17.170.179

    193.183.98.66

    207.148.83.241

    111.67.20.8

    103.236.162.119

    142.4.205.47

    213.136.85.253

    159.89.249.249

    82.196.9.45

  • exe_type

    worker

  • server_id

    550

rsa_pubkey.plain
serpent.plain

Signatures

Files

  • 305f2634325220221d799665a2386f67236f6602158b0ff4957b6a8c5a90f4bd
    .dll windows x86

    3c95b2d730ddee88d3f32d275de0dfcb


    Headers

    Imports

    Sections