General

  • Target

    2023-03-06-46.8.19.163-mise-server.exe.bin

  • Size

    311KB

  • Sample

    230316-f9d1eabe4z

  • MD5

    9390d0d62ea148b02178682114e49bc7

  • SHA1

    d6c55c43aacb6cc7fde55817747a6dc7f53df51c

  • SHA256

    fc3e7ff40a45bccd83617ea952eccdfc93301c6673cce8de33b4bf924b8957d9

  • SHA512

    d3c7f6f11e43af8d902ae7af89776a15628e0afe0c7147f92999e128d95c9f219808f062947ac4b45134337de366c6c5efec80d3420aca8307b159677e576b37

  • SSDEEP

    3072:B0IXPBdbWLT5TF9ChK0pMtplagPZhbYxGA4T7q2qlBfeeG55g2GWzLn8clInY9eY:3XPaLNunpbgwxm7q1lBfT2GW0Pc

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7710

C2

checklist.skype.com

62.173.140.103

31.41.44.63

46.8.19.239

185.77.96.40

46.8.19.116

31.41.44.48

62.173.139.11

62.173.138.251

Attributes
  • base_path

    /drew/

  • build

    250255

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Targets

    • Target

      2023-03-06-46.8.19.163-mise-server.exe.bin

    • Size

      311KB

    • MD5

      9390d0d62ea148b02178682114e49bc7

    • SHA1

      d6c55c43aacb6cc7fde55817747a6dc7f53df51c

    • SHA256

      fc3e7ff40a45bccd83617ea952eccdfc93301c6673cce8de33b4bf924b8957d9

    • SHA512

      d3c7f6f11e43af8d902ae7af89776a15628e0afe0c7147f92999e128d95c9f219808f062947ac4b45134337de366c6c5efec80d3420aca8307b159677e576b37

    • SSDEEP

      3072:B0IXPBdbWLT5TF9ChK0pMtplagPZhbYxGA4T7q2qlBfeeG55g2GWzLn8clInY9eY:3XPaLNunpbgwxm7q1lBfT2GW0Pc

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

MITRE ATT&CK Matrix

Tasks