Analysis
-
max time kernel
22s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
-
submitted
20-07-2022 17:34
General
-
Target
4e761919c560e462ce017a47ed2bf14ae78d80b11a1484005aa1e23fac0ac81d.exe
-
Size
203KB
-
MD5
e993c5db7488ef8ff012099c511aed15
-
SHA1
0329de2b04fb6cfd017d89f7e1f31e607be3bccd
-
SHA256
4e761919c560e462ce017a47ed2bf14ae78d80b11a1484005aa1e23fac0ac81d
-
SHA512
f09da0c2b6511163fd796236479c38e00dc6f5c2c49870aba8396d91b519d61777eec9d0f9e0078fd9bf5f9708616f58f49ab2f8ba1f111163d209c88ef5282f
Score
10/10
Malware Config
Extracted
Family
gozi_ifsb
Attributes
-
build
215165
Extracted
Family
gozi_ifsb
Botnet
3162
C2
menehleibe.com
liemuteste.com
thulligend.com
Attributes
-
build
215165
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
loader
-
server_id
12
rsa_pubkey.plain
serpent.plain
Signatures
-
Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e761919c560e462ce017a47ed2bf14ae78d80b11a1484005aa1e23fac0ac81d.exe"C:\Users\Admin\AppData\Local\Temp\4e761919c560e462ce017a47ed2bf14ae78d80b11a1484005aa1e23fac0ac81d.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
60KB
-
Filesize
108KB
-
Filesize
252KB