Analysis
-
max time kernel
58s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
11-02-2023 01:31
General
-
Target
84908c9c014c59a36369a618dfc51316646d1dbc3314da3c66100b0706567d22.exe
-
Size
186KB
-
MD5
8f055e79a2e55454c54e58de0219dd8c
-
SHA1
f2d95f53d10e0f1a76aa5b3f82eaa8975710d9f5
-
SHA256
84908c9c014c59a36369a618dfc51316646d1dbc3314da3c66100b0706567d22
-
SHA512
9353a7783cf2595358f210731e67f83b6de39e6e09931ffdb84f7eced19eadede98f909257918ca7ec9dd37cf67009484979f54271841c4ed1e9ec97f5334e52
-
SSDEEP
3072:3FgViTHQYI2m/IWZloyMX1GLvtoXUoDq51VGJ/Vw6jkORAK:3Fd7dmpZl4gTtokoDq51VG5GPORd
Score
10/10
Malware Config
Extracted
Family
gozi
Extracted
Family
gozi
Botnet
7708
C2
checklist.skype.com
62.173.147.156
31.41.44.3
46.8.19.140
45.151.232.3
62.173.139.21
185.142.99.47
31.41.44.121
Attributes
-
base_path
/drew/
-
build
250255
-
exe_type
loader
-
extension
.jlk
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
Gozi
Gozi is a well-known and widely distributed banking trojan.
Processes
-
C:\Users\Admin\AppData\Local\Temp\84908c9c014c59a36369a618dfc51316646d1dbc3314da3c66100b0706567d22.exe"C:\Users\Admin\AppData\Local\Temp\84908c9c014c59a36369a618dfc51316646d1dbc3314da3c66100b0706567d22.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
-
Filesize
76KB
-
Filesize
1.4MB
-
Filesize
52KB
-
Filesize
76KB
-
Filesize
1.4MB