Overview

overview

10

Static

static

10

2952a6ad1b...64.dll

windows7-x64

10

2952a6ad1b...64.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2952a6ad1ba0a56ea176672f3ec9b1ad8a92836839dc51f592eb253db60c96af_unpacked_x64

  • Size

    345KB

  • MD5

    63223be31de5e0ea133b2aaf8cd63e9c

  • SHA1

    28aa25ef0ca227656504d074b4107989a3847780

  • SHA256

    908a2b2d385a32d541c795b3fd4b4675502632935fc5b772bb0323798b4a47ad

  • SHA512

    0acd678c11462a397fe7176674229e6ca97481fd767be63e6c5ae5161f5e186dd3ab6fffc8bb6e0510098fc21fe22f0fe745d7207141a15a2644eb6396dfd564

  • SSDEEP

    6144:aImDEdF/rxGtCM0KfJyO9C3GMHxpbdP5Q9RPoqTiB+6k6X7O:aImYdF/rItCMV9C9hARPoqTiB+

Score
10/10
10008gozi_ifsb

Malware Config

Extracted

Family

gozi_ifsb

Botnet

10008

C2

jscallowallowallowjcli.me

disallowjscuserallow.pw
Attributes
  • build

    215801

  • dga_base_url

    z1.zedo.com/robots.txt

  • dga_crc

    0x246640bb

  • exe_type

    worker

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

Files

  • 2952a6ad1ba0a56ea176672f3ec9b1ad8a92836839dc51f592eb253db60c96af_unpacked_x64
    .dll windows x64

    85db2c520c2ed9f9d57aed9c49009c24


    Headers

    Imports

    Sections