Overview

overview

10

Static

static

10

576-57-0x0...ry.exe

windows7-x64

576-57-0x0...ry.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    576-57-0x0000000000400000-0x0000000000462000-memory.dmp

  • Size

    392KB

  • Sample

    221221-mt4z8afc8w

  • MD5

    c930a5ce4601f3c77ebcb66fb80b1dd6

  • SHA1

    864eb546ff82fbe2c7a13e23c8b76191a1e4ff03

  • SHA256

    08f52b83f8217f69ef19fc49037a5ee9f67ae0bda645e636a9035dd36503db97

  • SHA512

    2689459370653f6dcf7abd079f6945c1859da517998b78f47fe9dd364848abbd0fb39be096aa5cc7b4cb12ca47f33720716d16a1c1dc419601a9eef026b22e65

  • SSDEEP

    6144:C7SPYZnXk7bG+0ujknP+RKZJBCkIXuW85COBsleRu4:C7SPwsS3uAnPqKDoDOBT8

Score
10/10
gozi7639isfb

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7639

C2

31.41.44.43

62.173.147.143

31.41.44.63

62.173.147.113
Attributes
  • base_path

    /drew/

  • build

    250249

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Targets

    • Target

      576-57-0x0000000000400000-0x0000000000462000-memory.dmp

    • Size

      392KB

    • MD5

      c930a5ce4601f3c77ebcb66fb80b1dd6

    • SHA1

      864eb546ff82fbe2c7a13e23c8b76191a1e4ff03

    • SHA256

      08f52b83f8217f69ef19fc49037a5ee9f67ae0bda645e636a9035dd36503db97

    • SHA512

      2689459370653f6dcf7abd079f6945c1859da517998b78f47fe9dd364848abbd0fb39be096aa5cc7b4cb12ca47f33720716d16a1c1dc419601a9eef026b22e65

    • SSDEEP

      6144:C7SPYZnXk7bG+0ujknP+RKZJBCkIXuW85COBsleRu4:C7SPwsS3uAnPqKDoDOBT8

    Score
    1/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks