Overview

overview

10

Static

static

10

gozi.dll

windows7-x64

1

gozi.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    gozi.payload-disk

  • Size

    43KB

  • MD5

    4daae4e5b599410b39b55833d61819e7

  • SHA1

    8769d522b951aa86259e5239919045adaed05daa

  • SHA256

    53a152ce008fbe0a467f7816ed237692b3839495425b3b28844a5a032630a9e9

  • SHA512

    ff35a1ddf3fe10976a75580a670a1047c9b2e2ba922363587b894b081e2d19f58574cb4fbc3ced29de2098461752e4004587989129f030ecb41598b47a305883

  • SSDEEP

    768:TlYhzJ2VQEFfLCUeQCuu6Mf39Y+RMRZOz4yM7gp/6lvVp:TlYhzJ2VQEFf/2VYuAZOzNM7uyH

Score
10/10
1900gozi_ifsb

Malware Config

Extracted

Family

gozi_ifsb

Botnet

1900

C2

tel12.msn.com

194.76.225.60

185.212.47.133
Attributes
  • base_path

    /doorway/

  • build

    250240

  • exe_type

    loader

  • extension

    .drr

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • gozi.payload-disk
    .dll windows x86

    ef075d26b728b78a932306e24062e80c


    Headers

    Imports

    Sections