Overview

overview

10

Static

static

10

514b0d82fa...er.exe

windows7-x64

3

514b0d82fa...er.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54_unpacked_dropper

  • Size

    352KB

  • Sample

    221027-aejdraaben

  • MD5

    e27edfdff2db563ca367d20e0deec389

  • SHA1

    48597d839b5560a5418cf84c5bca750aa7fd092e

  • SHA256

    44264beecd758ab247ade0cd28db1b019af159202438a0708a956cbe4a234c44

  • SHA512

    97a4358f3804efaa7c10f485d7b35af17a0c3dcd107f07f49da09107f86ff70d25ffdea837c723a9f63ef2ea50de299e4f22f24ea21826aef12038dfba34fc8d

  • SSDEEP

    6144:iPSROmLBk0/s7qbnWNFJcV9z+g4dlJ2j7vn9AUovLhuDCl9L0/ePQKYFcfu:/Oos2WNDW9PMUZ2llZbMcf

Score
10/10
gozi_ifsb1000

Malware Config

Extracted

Family

gozi_ifsb

Botnet

1000

C2

rastobona.com

artefaki.com

spamhouseanilingus.ru

gazitivaton.ru
Attributes
  • build

    200000

  • exe_type

    worker

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54_unpacked_dropper

    • Size

      352KB

    • MD5

      e27edfdff2db563ca367d20e0deec389

    • SHA1

      48597d839b5560a5418cf84c5bca750aa7fd092e

    • SHA256

      44264beecd758ab247ade0cd28db1b019af159202438a0708a956cbe4a234c44

    • SHA512

      97a4358f3804efaa7c10f485d7b35af17a0c3dcd107f07f49da09107f86ff70d25ffdea837c723a9f63ef2ea50de299e4f22f24ea21826aef12038dfba34fc8d

    • SSDEEP

      6144:iPSROmLBk0/s7qbnWNFJcV9z+g4dlJ2j7vn9AUovLhuDCl9L0/ePQKYFcfu:/Oos2WNDW9PMUZ2llZbMcf

    Score
    3/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks