Overview

overview

10

Static

static

10

gozi.dll

windows7-x64

1

gozi.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    gozi.payload-disk

  • Size

    43KB

  • MD5

    4435bc98c1868f9a9078f930a201122e

  • SHA1

    ed848d89e3f557f813fe0f3e8129d7b4efc85b5b

  • SHA256

    437a7679dd60b9cc6fd4d34a6a74486d8f84e2965b1568191630f835211d3e10

  • SHA512

    859130eee9c9acf9cd09677c5e120085279c8dcd321f7ccd8219d04035a80d4f295629a95e212d500bff5504dcedbdba98c5c38908fd509297b4b7c9325a5279

  • SSDEEP

    768:BO60dvSXUWzHY4kD/zaho82WVV3rh5Uznoo7e6GzheOB/G7gpdS4JowCyjQBOZ+:BOLgy4kD/2H2WjbhcTGNeOdG7uS45QB1

Score
10/10
isfb1900gozi

Malware Config

Extracted

Family

gozi

Botnet

1900

C2

tel12.msn.com

194.76.225.60

185.212.47.133
Attributes
  • base_path

    /doorway/

  • build

    250249

  • exe_type

    loader

  • extension

    .drr

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • gozi.payload-disk
    .dll windows x86

    ef075d26b728b78a932306e24062e80c


    Headers

    Imports

    Sections