Overview

overview

10

Static

static

10

1508-179-0...ry.exe

windows7-x64

1

1508-179-0...ry.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1508-179-0x0000000000540000-0x000000000054E000-memory.dmp

  • Size

    56KB

  • Sample

    230217-c653yadd72

  • MD5

    d028f3cfd1bcbd910708029de70b23cc

  • SHA1

    c1747fd8921cafafdd2c9a50dde6b3b36871d51b

  • SHA256

    64739e149bccc65ce516e17f43a5c05183aa669d70e3df1729aa3aed82a9ca67

  • SHA512

    35dd74ec3fb83d4d4a8f035d21472126af3b0002067fd93937da12f6294f702296c8f938eb3cbf383026eaf5e9d81b35fd1304c0776da64f498f1475b226de6b

  • SSDEEP

    768:hO3aycHNoR4jInhpp55dWSlkiidEfUPJqBQPt04:haaycuR4jaDtmiuqURq

Score
10/10
gozi1001isfb

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

1001

C2

https://checklist.skype.com

http://176.10.125.84

http://91.242.219.235

http://79.132.130.73

http://176.10.119.209

http://194.76.225.88

http://79.132.134.158
Attributes
  • base_path

    /microsoft/

  • build

    250256

  • exe_type

    loader

  • extension

    .acx

  • server_id

    50

rsa_pubkey.plain
aes.plain

Targets

    • Target

      1508-179-0x0000000000540000-0x000000000054E000-memory.dmp

    • Size

      56KB

    • MD5

      d028f3cfd1bcbd910708029de70b23cc

    • SHA1

      c1747fd8921cafafdd2c9a50dde6b3b36871d51b

    • SHA256

      64739e149bccc65ce516e17f43a5c05183aa669d70e3df1729aa3aed82a9ca67

    • SHA512

      35dd74ec3fb83d4d4a8f035d21472126af3b0002067fd93937da12f6294f702296c8f938eb3cbf383026eaf5e9d81b35fd1304c0776da64f498f1475b226de6b

    • SSDEEP

      768:hO3aycHNoR4jInhpp55dWSlkiidEfUPJqBQPt04:haaycuR4jaDtmiuqURq

    Score
    3/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks