Analysis
-
max time kernel
39s -
max time network
45s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
12-07-2022 14:47
General
-
Target
4a0bd71db44ebca42e13f2556479cda473940438bd0bd7629aaefc684e99f0c1.exe
-
Size
203KB
-
MD5
3a5e164612d1b0edd9a7869ed9f5a86a
-
SHA1
17e36bfd5d916ea0ee8a465b8c565054d1a26107
-
SHA256
4a0bd71db44ebca42e13f2556479cda473940438bd0bd7629aaefc684e99f0c1
-
SHA512
6f9b6e33d613d51c73c02fb1bc9570a01f7177fa3e9a4bda3bfadc27febdb8b016399a5dfa11b5dd02c48fb7247792b6c2aefbd5274ff098742936a5585c8df8
Score
10/10
Malware Config
Extracted
Family
gozi_ifsb
Attributes
-
build
215165
Extracted
Family
gozi_ifsb
Botnet
3162
C2
menehleibe.com
liemuteste.com
thulligend.com
Attributes
-
build
215165
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
loader
-
server_id
12
rsa_pubkey.plain
serpent.plain
Signatures
-
Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a0bd71db44ebca42e13f2556479cda473940438bd0bd7629aaefc684e99f0c1.exe"C:\Users\Admin\AppData\Local\Temp\4a0bd71db44ebca42e13f2556479cda473940438bd0bd7629aaefc684e99f0c1.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
60KB
-
Filesize
108KB
-
Filesize
252KB