Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

1772-147-0...ry.dll

windows7-x64

3

1772-147-0...ry.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1772-147-0x00000000011F0000-0x00000000011FD000-memory.dmp

  • Size

    52KB

  • Sample

    230208-mt4z8ahh4s

  • MD5

    34a83cc9cd477dc0e67a72f9b6f3f7f6

  • SHA1

    395dfec4a565e77b13ba86bb9c9cbab71b1b922e

  • SHA256

    d02e00a71619e93123f27b2386af2f58ed7e8b85b059aaa50f3cd4934c58ea23

  • SHA512

    ffeef09e7d8184f79b5cd397699f59fbe47b9e44e7d2bf1e3b1b1a11befb0099edbd61e6cb5360972a3f6a4851d827f657edb23372655947d7e1f18a0e779f2f

  • SSDEEP

    768:5YCZ1LDKw4WqGC+jxSi2Gd3FPsZe5ILAd3IymvsP4GJFrVzhASpZe:eCZ1Kw4WqGCQ3d3FPAeaL633asP9rPe

Score
10/10
gozi1001isfb

Malware Config

Extracted

Family

gozi

Botnet

1001

C2

https://checklist.skype.com

http://176.10.125.84

http://91.242.219.235

http://79.132.130.73

http://176.10.119.209

http://194.76.225.88

http://79.132.134.158
Attributes
  • base_path

    /microsoft/

  • build

    260255

  • exe_type

    loader

  • extension

    .acx

  • server_id

    50

rsa_pubkey.plain
aes.plain

Targets

    • Target

      1772-147-0x00000000011F0000-0x00000000011FD000-memory.dmp

    • Size

      52KB

    • MD5

      34a83cc9cd477dc0e67a72f9b6f3f7f6

    • SHA1

      395dfec4a565e77b13ba86bb9c9cbab71b1b922e

    • SHA256

      d02e00a71619e93123f27b2386af2f58ed7e8b85b059aaa50f3cd4934c58ea23

    • SHA512

      ffeef09e7d8184f79b5cd397699f59fbe47b9e44e7d2bf1e3b1b1a11befb0099edbd61e6cb5360972a3f6a4851d827f657edb23372655947d7e1f18a0e779f2f

    • SSDEEP

      768:5YCZ1LDKw4WqGC+jxSi2Gd3FPsZe5ILAd3IymvsP4GJFrVzhASpZe:eCZ1Kw4WqGCQ3d3FPAeaL633asP9rPe

    Score
    3/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks