Overview

overview

10

Static

static

10

gozi.dll

windows7-x64

1

gozi.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    gozi.payload-disk

  • Size

    43KB

  • MD5

    b386d856871dea7395b6c54b6f0f48da

  • SHA1

    0f1d609ff04c53898e8b4530d57809af38490f76

  • SHA256

    7053fb81a6352a4c60ea64cf35bced1b6dfaa7a1c64205d093bf030f41793ea6

  • SHA512

    13bc637d555e123f618368b83f0d96b8dca33154497fe9e82a9812674f831a19c3cfbcedcc37151546131c459e4d5bbae26d2e07665ce3e38259f185ac0af1ed

  • SSDEEP

    768:Ss0zIQOuf1WrHWngROYD3Ps8WyAqa5v+BZ20efofs7gpdsmTa:SsSIQO8184gRO8sxp+BE0efUs7K1T

Score
10/10
isfb5050gozi

Malware Config

Extracted

Family

gozi

Botnet

5050

C2

https://config.edge.skype.com

twinean.com
Attributes
  • base_path

    /jerry/

  • build

    250257

  • exe_type

    loader

  • extension

    .bob

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi family
    gozi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • gozi.payload-disk
    .dll windows x86

    ef075d26b728b78a932306e24062e80c


    Headers

    Imports

    Sections