Static

static

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    sample2.dll

  • Size

    37KB

  • MD5

    49a0b4ba3d6ac50585e73b8116a9f694

  • SHA1

    4c5810f94ed10b86b894be8b427e237a735d3beb

  • SHA256

    7e835456156908ae8edc17ac7d17faaea9f5d9686c20ec757e62c610d3f79330

  • SHA512

    a7396b6dc55e145ad6f7e1fb0656fc10317d7d7e163800f35b29dd2a039785409f49062d508759cc249b316d0fde9342c317b0d9f1d95d7b7f0c3494ac972ba9

  • SSDEEP

    768:qbQ3ZaF3VHoyVcUT0LrqH6EHV9HmDXhVp/s6zTgMlbDlxKWAb2S/0:qbcZaF3egVmHG9HCx/jzTtbBxKj0

Score
10/10
isfb2004gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

2004

C2

trackingg-protectioon.cdn4.mozilla.net

77.73.131.105

31.214.157.31

protectioon.cdn4.mozilla.net

185.212.47.59

79.132.128.116
Attributes
  • base_path

    /fonts/

  • build

    250257

  • exe_type

    loader

  • extension

    .bak

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi family
    gozi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • sample2.dll
    .exe windows x86

    1640d668d1471f340cbe565fe63522f6


    Headers

    Imports

    Sections