Overview

overview

10

Static

static

10

gozi.dll

windows7-x64

1

gozi.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    gozi.payload-disk

  • Size

    43KB

  • MD5

    6fb0fe486a5669389233ff965ea1e105

  • SHA1

    1c950f4ea06c2c5a16d4e58543400b0738a7c683

  • SHA256

    7bad5055221930bb50fd9f8b5feb66e47c6edfbaa95de2a2f70be4af771c547d

  • SHA512

    944e286d31993bf55788cbb57b93120d738e2a1b15c08d5718886c878161a0feee5a42a2a55a6ce10e006d89f61e9f1ba9ba4c8233443e4e130a0cb47e6a08db

  • SSDEEP

    768:NO60dvSXUWzHY4kD/zaho82WVV3rh5Uznoo7e6GzheOB/G7gpdS4JowCyjQBOi:NOLgy4kD/2H2WjbhcTGNeOdG7uS45QBX

Score
10/10
isfb50000gozi

Malware Config

Extracted

Family

gozi

Botnet

50000

C2

http://confisg.edges.skype.com

http://108.61.165.145

http://37.120.222.23

http://194.76.224.234

http://176.10.111.47
Attributes
  • base_path

    /grome/

  • build

    250249

  • exe_type

    loader

  • extension

    .chk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • gozi.payload-disk
    .dll windows x86

    ef075d26b728b78a932306e24062e80c


    Headers

    Imports

    Sections