General

  • Target

    c3a0000.dll.exe

  • Size

    227KB

  • MD5

    8b5e0e3d0173042867ffc0147b1431d0

  • SHA1

    06b4268c98692444c083f2c9d6084d85be2e923f

  • SHA256

    3e099b9a4d2092444a335dad2a3ad688b4c981b1a5e4e522f489c59a3e6f4e6a

  • SHA512

    c6a0f17ec478245be7010135938ec05a9f96532ec60179d7b46bc2debbb9709c1b4064aa1d82d505a84282d823370c9a02cb8a283f11056e0d6e966a4f34f13b

  • SSDEEP

    3072:UlfGqwJTeTEom3lIkR2SCD6q9KgyItk78mV0dfgxT/cqAOw5VgCK5hcjAPxJFocW:UlDosEPR66q9KgylInd6oqAOD5DnFoc

Score
10/10

Malware Config

Extracted

Family

gozi_ifsb

Botnet

10103

C2

trackingg-protectioon.cdn1.mozilla.net

45.8.158.104

188.127.224.114

weiqeqwns.com

wdeiqeqwns.com

weiqeqwens.com

weiqewqwns.com

iujdhsndjfks.com

Attributes
  • base_path

    /uploaded/

  • exe_type

    worker

  • extension

    .pct

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • c3a0000.dll.exe
    .dll windows x64

    81de4ee1071a8320787d7c9e149ace7f


    Headers

    Imports

    Sections