Overview

overview

10

Static

static

10

69d6464418...f8.dll

windows7-x64

10

69d6464418...f8.dll

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    69d646441885a01d2203c17d5b38c1772d0f8cb76d0a43d33d143e7a0b13f6f8.zip

  • Size

    34KB

  • MD5

    4b56f2ab7db0fa81a3ff67224ea21da0

  • SHA1

    8b103b6ebcdbc77cf5c2040d852ee9da0da333ca

  • SHA256

    6e8f53d3f1915e1c4ad6dcf83fb2a0c86b757d6854076671ad84aefccd49fc5d

  • SHA512

    b4f607c8eb7eb1fa50a10fedcc93ae309d960ce6931ad29c3ee7e4a6365493d15db14aa1a0866601ebe800b3dcda3db48d65a1ae824e20864ef0ee050ab4f700

  • SSDEEP

    768:WA0BesizOQWoq7Smrb+TsLeRnSuCKqOWiHLmbyhkdnr:WA0ksizOQWn7msaRSuCKqOWALmb8kdr

Score
10/10
isfb5050gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

C2

https://config.edge.skype.com

91.215.85.201
Attributes
  • base_path

    /jerry/

  • build

    250255

  • exe_type

    loader

  • extension

    .bob

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • 69d646441885a01d2203c17d5b38c1772d0f8cb76d0a43d33d143e7a0b13f6f8.zip
    .zip

    Password: infected

  • 69d646441885a01d2203c17d5b38c1772d0f8cb76d0a43d33d143e7a0b13f6f8.dll
    .dll regsvr32 windows x86

    Password: infected

    3e85858f9f91b022a15a56437fb6f7c2


    Headers

    Imports

    Exports

    Sections