General

  • Target

    5a685fddf1cedd48e8e23eba045c916f2ebba8454abd79c212bb746039e5ff4d

  • Size

    1.6MB

  • Sample

    220802-d7kn3aaegn

  • MD5

    11abc79217eefe0227ce1435bcd55823

  • SHA1

    35e00dc34fecd7dd4177cad3a38c0439c8f7b01a

  • SHA256

    5a685fddf1cedd48e8e23eba045c916f2ebba8454abd79c212bb746039e5ff4d

  • SHA512

    5f0762d757652761a4f1d0a4650f9beb50b2d9795c25db9f5fd0b1fec1f1d8b7a0f286a3411613d25ffd58ad9257079dce2d200fe5500f84e3e00a34f91af762

Malware Config

Extracted

Family

gozi_ifsb

Attributes
  • build

    214107

Extracted

Family

gozi_ifsb

Botnet

3531

C2

gmail.com

google.com

k55gaisi.com

leinwqoa.com

bon11ljgarry.com

Attributes
  • build

    214107

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      5a685fddf1cedd48e8e23eba045c916f2ebba8454abd79c212bb746039e5ff4d

    • Size

      1.6MB

    • MD5

      11abc79217eefe0227ce1435bcd55823

    • SHA1

      35e00dc34fecd7dd4177cad3a38c0439c8f7b01a

    • SHA256

      5a685fddf1cedd48e8e23eba045c916f2ebba8454abd79c212bb746039e5ff4d

    • SHA512

      5f0762d757652761a4f1d0a4650f9beb50b2d9795c25db9f5fd0b1fec1f1d8b7a0f286a3411613d25ffd58ad9257079dce2d200fe5500f84e3e00a34f91af762

MITRE ATT&CK Enterprise v6

Tasks