Overview

overview

10

Static

static

7078612.dll

windows7-x64

10

7078612.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7078612

  • Size

    496KB

  • Sample

    221123-lp88psfd5w

  • MD5

    cba263871219062d981111b00cc131fc

  • SHA1

    50e2c7caf7dd0f826bc6e814bd62fbb39982ceed

  • SHA256

    65f687a5c0e757cd8e296f8b0453b27726e5017502e93dcb8379d59fe9c056a3

  • SHA512

    147ce45b24d541edb048ae1e3b82fbdb72e4f88be6fcad04c16d0eaa761f1c3120fdd49a371bf458556b7e1ee03152d48cd5a77cb6a095a63ae238d5929492d3

  • SSDEEP

    6144:VcmfGth2n/4QpDArdVgncHm3pPXig93bNvKQ7lzLNc0RMkHsBAih:XYwFxAmcHm5vigDvKQBzTM/f

Score
10/10
gozi5050bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

C2

config.edge.skype.com

meganetwork.top

supernetwork.top

internetcoca.in

31.207.46.124

139.60.163.161

dendexmm.com
Attributes
  • base_path

    /jerry/

  • build

    250249

  • exe_type

    loader

  • extension

    .bob

  • server_id

    50

rsa_pubkey.plain
aes.plain

Targets

    • Target

      7078612

    • Size

      496KB

    • MD5

      cba263871219062d981111b00cc131fc

    • SHA1

      50e2c7caf7dd0f826bc6e814bd62fbb39982ceed

    • SHA256

      65f687a5c0e757cd8e296f8b0453b27726e5017502e93dcb8379d59fe9c056a3

    • SHA512

      147ce45b24d541edb048ae1e3b82fbdb72e4f88be6fcad04c16d0eaa761f1c3120fdd49a371bf458556b7e1ee03152d48cd5a77cb6a095a63ae238d5929492d3

    • SSDEEP

      6144:VcmfGth2n/4QpDArdVgncHm3pPXig93bNvKQ7lzLNc0RMkHsBAih:XYwFxAmcHm5vigDvKQBzTM/f

    Score
    10/10
    gozi5050bankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks