Overview

overview

10

Static

static

10

f3a0000.dll

windows7-x64

1

f3a0000.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f3a0000.dll.exe

  • Size

    227KB

  • Sample

    220901-rg9r6aggg5

  • MD5

    276eb618a19dba775527f985e9bd2dbe

  • SHA1

    b8bf862c00854116b11e3c724e108d85aeec42e6

  • SHA256

    40dafe4e82513adde4bda0705f4a6992e26ef498587241c25f9bacdf075e36ac

  • SHA512

    e1fded1350f1965893b5910eba97ecdeafee14d9268804df3754b55c96f6e74f60d623e78609ba71cfb56698a58fbad6d3aa7a7076964ef848197457fc93ff37

  • SSDEEP

    3072:X5hinZgCo+NjJWSsznC2OCyzjFIz4V1T/JDR1vHBB78C752cjbQ5e:X+nZ1o+NJWbn2CMFIzSTRDR1vHR5g

Score
10/10
gozi_ifsb11111

Malware Config

Extracted

Family

gozi_ifsb

Botnet

11111

C2

trackin1g-protection.cdnn.mozilla.net

176.10.119.80

194.76.224.245

31.214.157.77

chnkdgpopupser.at

185.158.250.220

185.158.250.234

194.76.224.181
Attributes
  • base_path

    /fonts/

  • exe_type

    worker

  • extension

    .bak

  • server_id

    50

rsa_pubkey.plain
aes.plain

Targets

    • Target

      f3a0000.dll.exe

    • Size

      227KB

    • MD5

      276eb618a19dba775527f985e9bd2dbe

    • SHA1

      b8bf862c00854116b11e3c724e108d85aeec42e6

    • SHA256

      40dafe4e82513adde4bda0705f4a6992e26ef498587241c25f9bacdf075e36ac

    • SHA512

      e1fded1350f1965893b5910eba97ecdeafee14d9268804df3754b55c96f6e74f60d623e78609ba71cfb56698a58fbad6d3aa7a7076964ef848197457fc93ff37

    • SSDEEP

      3072:X5hinZgCo+NjJWSsznC2OCyzjFIz4V1T/JDR1vHBB78C752cjbQ5e:X+nZ1o+NJWbn2CMFIzSTRDR1vHR5g

    Score
    1/10
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks