Overview

overview

10

Static

static

10

powershell_bad.ps1

windows7-x64

10

powershell_bad.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    powershell_bad.ps1

  • Size

    753KB

  • Sample

    220929-enwsnaagem

  • MD5

    b6cb1b34533ec12131414aa43ad25820

  • SHA1

    e9d36f5e85301a067427db5e33522997c578a164

  • SHA256

    198a4e6953c2fab088c40f305d9a659bafc2caa00ee310c668172773e10054f6

  • SHA512

    35b6fa02bed293267e36d62cd751204a35d111a3e0b18ae991363a69dee729af31278c311798a0f9476a82d1069f2ae37497036c1b1e06be13fbc365ea53491b

  • SSDEEP

    1536:Vwwq2KKIkb1O7RSanp5cuaZRiLccsunDiJhRs7HI1xXYWLOx+4G+gW7+wjrNEaDa:VF

Score
10/10
gozi_ifsb10101bankertrojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

10101

C2

trackingg-protectioon.cdn1.mozilla.net

45.8.158.104

188.127.224.114

weiqeqwns.com

wdeiqeqwns.com

weiqeqwens.com

weiqewqwns.com

iujdhsndjfks.com
Attributes
  • base_path

    /uploaded/

  • exe_type

    worker

  • extension

    .pct

  • server_id

    50

rsa_pubkey.plain
aes.plain

Targets

    • Target

      powershell_bad.ps1

    • Size

      753KB

    • MD5

      b6cb1b34533ec12131414aa43ad25820

    • SHA1

      e9d36f5e85301a067427db5e33522997c578a164

    • SHA256

      198a4e6953c2fab088c40f305d9a659bafc2caa00ee310c668172773e10054f6

    • SHA512

      35b6fa02bed293267e36d62cd751204a35d111a3e0b18ae991363a69dee729af31278c311798a0f9476a82d1069f2ae37497036c1b1e06be13fbc365ea53491b

    • SSDEEP

      1536:Vwwq2KKIkb1O7RSanp5cuaZRiLccsunDiJhRs7HI1xXYWLOx+4G+gW7+wjrNEaDa:VF

    Score
    10/10
    gozi_ifsb10101bankertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks