gozi | 67a78fbceb3ffbc36f3ac88c04f7a2c1cbaff236ae09a1dbbdbb547b54b5c8a5 | Triage

Sharing

General

Target

67a78fbceb3ffbc36f3ac88c04f7a2c1cbaff236ae09a1dbbdbb547b54b5c8a5
Size

461KB
Sample

230129-zx8h2ach77
MD5

7a258790fc13ff0e818cacc79a24087a
SHA1

f389d76bd08ba87f77642f1c04ad089a860d64c0
SHA256

67a78fbceb3ffbc36f3ac88c04f7a2c1cbaff236ae09a1dbbdbb547b54b5c8a5
SHA512

3c49548dd44ccc1c0a79ce0e0d99de29039d299ed094d21840bcac574a1764ac6f69e4238ab2ed6f00049d41f80f3a3d34fcc16acc6508b3f8565fe1c59496e1
SSDEEP

6144:otEtEtEtEtEtEtEtEtEtEt9WO2gUXdCpnZavQqf:Ceeeeeeeeee9xwcaz

Score

10^/10

gozi 89820235 banker cryptone packer rm3 trojan

Malware Config

Extracted

Family

gozi

Attributes

build
300898

Extracted

Family

gozi

Botnet

89820235

C2

https://exeupay.xyz

Attributes

build
300898
exe_type
loader
server_id
12
url_path
index.htm

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  67a78fbceb3ffbc36f3ac88c04f7a2c1cbaff236ae09a1dbbdbb547b54b5c8a5
- Size
  
  461KB
- MD5
  
  7a258790fc13ff0e818cacc79a24087a
- SHA1
  
  f389d76bd08ba87f77642f1c04ad089a860d64c0
- SHA256
  
  67a78fbceb3ffbc36f3ac88c04f7a2c1cbaff236ae09a1dbbdbb547b54b5c8a5
- SHA512
  
  3c49548dd44ccc1c0a79ce0e0d99de29039d299ed094d21840bcac574a1764ac6f69e4238ab2ed6f00049d41f80f3a3d34fcc16acc6508b3f8565fe1c59496e1
- SSDEEP
  
  6144:otEtEtEtEtEtEtEtEtEtEt9WO2gUXdCpnZavQqf:Ceeeeeeeeee9xwcaz
Score

10^/10

gozi 89820235 banker rm3 trojan
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

gozi89820235bankerrm3trojan

behavioral2

gozi89820235bankerrm3trojan