gozi | 859aeab73bdbd801a1a9bf80f83587a3e18558de9112535a9ff476eb762d7f73

Analysis

max time kernel
56s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 13:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

859aeab73bdbd801a1a9bf80f83587a3e18558de9112535a9ff476eb762d7f73.exe
Size

248KB
MD5

2676933e42cea9efb833f4c3851ca2f3
SHA1

0abfa4aa28332eb046dee312500aae8d97702a78
SHA256

859aeab73bdbd801a1a9bf80f83587a3e18558de9112535a9ff476eb762d7f73
SHA512

3369e70ccdb6b9a3cd00cdf4f53e43f19b2980c1d5426928b8bacc3d60cf6e6f7d80b9455a67e377979dbbf852c100213561dbc0ffa5517d516dba629b5222f3
SSDEEP

6144:dBibRXoI8d3jCx2mZCrtCkAQV/G3t2dBkS:d8lXoJt1mZOQkAQVWkkS

Score

10^/10

gozi 3000 banker isfb trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

3000

fonotarka.ru

bonvinuta.ru

tmp1.super-list.ru

net7.dns9free.ru

catalog-new.ru

Attributes

exe_type
worker
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

C:\Users\Admin\AppData\Local\Temp\859aeab73bdbd801a1a9bf80f83587a3e18558de9112535a9ff476eb762d7f73.exe
"C:\Users\Admin\AppData\Local\Temp\859aeab73bdbd801a1a9bf80f83587a3e18558de9112535a9ff476eb762d7f73.exe"
1⤵
PID:1900

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1900-54-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download
memory/1900-55-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1900-56-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads