General

  • Target

    gozi.payload-disk

  • Size

    43KB

  • MD5

    58d730d0bc84dc6e4091c29c89c0a21f

  • SHA1

    a6d4b619fcce06d645844f426252250e822069af

  • SHA256

    48530e21133c0343bd3b986ef2a5e352633e6c8ed5d9faa147254409fc36bfdd

  • SHA512

    c7acbb6905c42abb1b1071ceeda1f4d79aa1fa216c8926126c253091f556035dc0f3b62e66043810a9c18a352f9bcf5c77d3c3a3f47c717f404bfc511c9bd1e7

  • SSDEEP

    768:+lYhzJ2VQEFfLCUeQCuu6Mf39Y+RMRZOz4yM7gp/6lvVpZ:+lYhzJ2VQEFf/2VYuAZOzNM7uyHZ

Score
10/10

Malware Config

Extracted

Family

gozi_ifsb

Botnet

99999

C2

trackingg-protectioon.cdn1.mozilla.net

194.76.225.168

194.76.224.242

Attributes
  • base_path

    /fonts/

  • build

    250240

  • exe_type

    loader

  • extension

    .bak

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • gozi.payload-disk
    .dll windows x86

    ef075d26b728b78a932306e24062e80c


    Headers

    Imports

    Sections