Overview

overview

10

Static

static

859aeab73b...73.exe

windows7-x64

10

859aeab73b...73.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    859aeab73bdbd801a1a9bf80f83587a3e18558de9112535a9ff476eb762d7f73

  • Size

    248KB

  • Sample

    221029-qn8b8shghj

  • MD5

    2676933e42cea9efb833f4c3851ca2f3

  • SHA1

    0abfa4aa28332eb046dee312500aae8d97702a78

  • SHA256

    859aeab73bdbd801a1a9bf80f83587a3e18558de9112535a9ff476eb762d7f73

  • SHA512

    3369e70ccdb6b9a3cd00cdf4f53e43f19b2980c1d5426928b8bacc3d60cf6e6f7d80b9455a67e377979dbbf852c100213561dbc0ffa5517d516dba629b5222f3

  • SSDEEP

    6144:dBibRXoI8d3jCx2mZCrtCkAQV/G3t2dBkS:d8lXoJt1mZOQkAQVWkkS

Score
10/10
gozi3000bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

3000

C2

fonotarka.ru

bonvinuta.ru

tmp1.super-list.ru

net7.dns9free.ru

catalog-new.ru
Attributes
  • exe_type

    worker

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      859aeab73bdbd801a1a9bf80f83587a3e18558de9112535a9ff476eb762d7f73

    • Size

      248KB

    • MD5

      2676933e42cea9efb833f4c3851ca2f3

    • SHA1

      0abfa4aa28332eb046dee312500aae8d97702a78

    • SHA256

      859aeab73bdbd801a1a9bf80f83587a3e18558de9112535a9ff476eb762d7f73

    • SHA512

      3369e70ccdb6b9a3cd00cdf4f53e43f19b2980c1d5426928b8bacc3d60cf6e6f7d80b9455a67e377979dbbf852c100213561dbc0ffa5517d516dba629b5222f3

    • SSDEEP

      6144:dBibRXoI8d3jCx2mZCrtCkAQV/G3t2dBkS:d8lXoJt1mZOQkAQVWkkS

    Score
    10/10
    gozi3000bankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks